Attachment 295953 Details for Bug 430595 – audit.log for ssh login

audit.log for ssh login

audit.log (text/plain), 10.44 KB, created by Kevin R. Page on 2008-02-26 16:56:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kevin R. Page

Created: 2008-02-26 16:56:27 UTC

Size: 10.44 KB

patch

obsolete

>type=USER_AUTH msg=audit(1204044687.799:1436): user pid=19304 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=krp exe="/usr/sbin/sshd" (hostname=keyop.ecs.soton.ac.uk, addr=152.78.64.1, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1204044687.923:1437): user pid=19304 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=krp exe="/usr/sbin/sshd" (hostname=keyop.ecs.soton.ac.uk, addr=152.78.64.1, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1204044688.073:1438): user pid=19304 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=krp exe="/usr/sbin/sshd" (hostname=keyop.ecs.soton.ac.uk, addr=152.78.64.1, terminal=ssh res=success)'
>type=LOGIN msg=audit(1204044688.074:1439): login pid=19304 uid=0 old auid=4294967295 new auid=1976
>type=AVC msg=audit(1204044688.077:1440): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/yaffle_vg0-yaffle_lv_root" dev=tmpfs ino=329 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.077:1440): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e21e14 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.077:1441): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/md0" dev=tmpfs ino=7161 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.077:1441): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e710 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.078:1442): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/yaffle_vg0-yaffle_lv_tmp_precrypt" dev=tmpfs ino=336 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.078:1442): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e710 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.078:1443): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/yaffle_vg0-yaffle_lv_usr" dev=tmpfs ino=338 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.078:1443): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e734 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.078:1444): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/yaffle_vg0-yaffle_lv_media" dev=tmpfs ino=342 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.078:1444): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e72b items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.078:1445): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/_dev_mapper_yaffle_vg0-yaffle_lv_krp_cryptmount" dev=tmpfs ino=13079 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.078:1445): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e720 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.078:1446): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/_dev_mapper_yaffle_vg0-yaffle_lv_common_cryptmount" dev=tmpfs ino=13283 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.078:1446): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e747 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.123:1447): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/yaffle_vg0-yaffle_lv_root" dev=tmpfs ino=329 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.123:1447): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e240b4 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.123:1448): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/md0" dev=tmpfs ino=7161 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.123:1448): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e710 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.124:1449): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/yaffle_vg0-yaffle_lv_tmp_precrypt" dev=tmpfs ino=336 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.124:1449): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e710 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.124:1450): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/yaffle_vg0-yaffle_lv_usr" dev=tmpfs ino=338 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.124:1450): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e734 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.124:1451): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/yaffle_vg0-yaffle_lv_media" dev=tmpfs ino=342 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.124:1451): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e72b items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.124:1452): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/_dev_mapper_yaffle_vg0-yaffle_lv_krp_cryptmount" dev=tmpfs ino=13079 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.124:1452): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e720 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.124:1453): avc:  denied  { getattr } for  pid=19304 comm="sshd" path="/dev/mapper/_dev_mapper_yaffle_vg0-yaffle_lv_common_cryptmount" dev=tmpfs ino=13283 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1204044688.124:1453): arch=40000003 syscall=195 success=no exit=-13 a0=b8e1e700 a1=bfb2e8c0 a2=5e1ff4 a3=b8e1e747 items=0 ppid=2670 pid=19304 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1204044688.209:1454): avc:  denied  { execute } for  pid=19324 comm="sshd" name="pmvarrun" dev=dm-2 ino=3949667 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file
>type=SYSCALL msg=audit(1204044688.209:1454): arch=40000003 syscall=11 success=no exit=-13 a0=b8e1db50 a1=bfb31918 a2=b8e1a410 a3=0 items=0 ppid=19304 pid=19324 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1204044688.335:1455): user pid=19304 uid=0 auid=1976 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=krp exe="/usr/sbin/sshd" (hostname=keyop.ecs.soton.ac.uk, addr=152.78.64.1, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1204044688.519:1456): user pid=19325 uid=0 auid=1976 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=krp exe="/usr/sbin/sshd" (hostname=keyop.ecs.soton.ac.uk, addr=152.78.64.1, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1204044688.740:1457): user pid=19304 uid=0 auid=1976 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='uid=1976: exe="/usr/sbin/sshd" (hostname=keyop.ecs.soton.ac.uk, addr=152.78.64.1, terminal=/dev/pts/2 res=success)'
>

Actions: View

Attachments on bug 430595: 293213 | 293214 | 293215 | 293216 | 293217 | 293218 | 295953