Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looks like pam_tty_audit in Linux ( could have been a great way to help figure out "what happened!" when one gets rooted.

I say "could have been" because the rootkits do clean logs and kill remote logging before they do anything else.

Say I know that some of my OpenVZ containers get rooted and I trust that my OpenVZ hardware root did not. Could I have audited from the OpenVZ hardware node on all the TTYs of the containers?

share|improve this question

Instead of catching audit logs with auditd, you can configure syslog on the OpenVZ VE to send all logs to a remote server (which could be the OpenVZ HN itself, for example). Thus, all audit events would be safe from a VE compromise.

I'm marking this answer as wiki in case somebody wants to provide further details.

share|improve this answer
I agree. Thank you. I now have 2 more points: (1) The HN has direct access to the TTYs; (2) It would be easier to for the adversary to kill remote logging than to avoid TTYs. I edited my question to reflect your input. – Aleksandr Levchuk Aug 3 '11 at 7:11
As a side note, keep in mind it is not necessary to use a TTY for hacking. A vulnerable service could be used to establish a C&C channel for the attacker without a single blip on TTYs. – joechip Aug 3 '11 at 14:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.