Bug 121507

Summary: FC1 syslog.conf logs auth msgs to /var/log/messages
Product: [Fedora] Fedora Reporter: Need Real Name <vader>
Component: sysklogdAssignee: Jason Vas Dias <jvdias>
Status: CLOSED CURRENTRELEASE QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 1Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-08-04 14:33:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Need Real Name 2004-04-22 07:49:54 UTC 
Description of problem:
The default syslog.conf provided with FC1 has these lines:

# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none   /var/log/messages

However, authentication messages *do* get logged to /var/log/messages.

"auth" needs to be added to the above string, so it reads:

*.info;mail.none;auth,authpriv.none;cron.none   /var/log/messages


Version-Release number of selected component (if applicable):
1.4.1-13
Comment 1 Bill Nottingham 2004-04-22 20:32:15 UTC 
What changed from authpriv to auth? What specific messages do you see?
Comment 2 Need Real Name 2004-04-22 20:59:29 UTC 
From su and login, for example:

Apr 22 16:54:50 host su(pam_unix)[2716]: session opened for user root
by vader(uid=0)
Apr 22 16:54:50 host su(pam_unix)[2716]: session closed for user root
Apr 22 16:54:58 host login(pam_unix)[1047]: session opened for user
root by LOGIN(uid=0)
Apr 22 16:54:58 host  -- root[1047]: ROOT LOGIN ON tty1
Apr 22 16:55:02 host login(pam_unix)[1047]: session closed for user root
Comment 3 Jason Vas Dias 2004-08-04 14:33:34 UTC 
In fc2+, syslog.conf is now:
"
# Don't log private authentication messages!
*.info;mail.none;news.none;authpriv.none;cron.none             
/var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure
"
These messages:
Apr 22 16:54:50 host su(pam_unix)[2716]: session closed for user root
Apr 22 16:54:50 host su(pam_unix)[2716]: session closed for user root
are auth.info messages; users can direct them 
elsewhere using syslog.conf, but by default they
are caught by
*.info;...   /var/log/messages