Attachment 293216 Details for Bug 430595 – logs: sshd - user without pam_mounted crypted home

logs: sshd - user without pam_mounted crypted home

ssh_non-crypt_homedir (text/plain), 2.84 KB, created by Kevin R. Page on 2008-01-28 22:39:35 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kevin R. Page

Created: 2008-01-28 22:39:35 UTC

Size: 2.84 KB

patch

obsolete

>audit.log:
>
>type=USER_AUTH msg=audit(1201547423.389:182): user pid=5123 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=testuser exe="/usr/sbin/sshd" (hostname=82-68-41-195.dsl.in-addr.zen.co.uk, addr=82.68.41.195, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1201547423.527:183): user pid=5123 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=testuser exe="/usr/sbin/sshd" (hostname=82-68-41-195.dsl.in-addr.zen.co.uk, addr=82.68.41.195, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1201547423.677:184): user pid=5123 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=testuser exe="/usr/sbin/sshd" (hostname=82-68-41-195.dsl.in-addr.zen.co.uk, addr=82.68.41.195, terminal=ssh res=success)'
>type=LOGIN msg=audit(1201547423.679:185): login pid=5123 uid=0 old auid=4294967295 new auid=500
>type=AVC msg=audit(1201547423.682:186): avc:  denied  { execute } for  pid=5127 comm="sshd" name="pmvarrun" dev=dm-2 ino=3949781 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file
>type=SYSCALL msg=audit(1201547423.682:186): arch=40000003 syscall=11 success=no exit=-13 a0=b9c1c570 a1=bff29d18 a2=b9c1c508 a3=0 items=0 ppid=5123 pid=5127 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1201547423.823:187): user pid=5123 uid=0 auid=500 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=testuser exe="/usr/sbin/sshd" (hostname=82-68-41-195.dsl.in-addr.zen.co.uk, addr=82.68.41.195, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1201547423.959:188): user pid=5128 uid=0 auid=500 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=testuser exe="/usr/sbin/sshd" (hostname=82-68-41-195.dsl.in-addr.zen.co.uk, addr=82.68.41.195, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1201547424.103:189): user pid=5123 uid=0 auid=500 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=82-68-41-195.dsl.in-addr.zen.co.uk, addr=82.68.41.195, terminal=/dev/pts/3 res=success)'
>
>
>/var/log/messages:
>
>Jan 28 19:08:23 yaffle setroubleshoot: #012    SELinux is preventing /usr/sbin/sshd (sshd_t) "execute" to <Unknown> (bin_t).#012     For complete SELinux messages. run sealert -l 1a47833d-8491-426b-983c-09edd6b49679
>Jan 28 19:10:26 yaffle setroubleshoot:last message repeated 2 times
>
>
>/var/log/secure:
>
>Jan 28 19:13:31 yaffle sshd[5222]: Accepted password for testuser from 82.68.41.195 port 42734 ssh2
>Jan 28 19:13:31 yaffle sshd[5222]: pam_unix(sshd:session): session opened for user testuser by (uid=0)
>Jan 28 19:13:31 yaffle sshd[5222]: pam_mount(pam_mount.c:332) error executing /usr/sbin/pmvarrun
>

Actions: View

Attachments on bug 430595: 293213 | 293214 | 293215 | 293216 | 293217 | 293218 | 295953