Consider a couple of engineers toying with a remote machine via ssh. Everyone has a root access, which is bad, I know, but that's how it is. Thankfully, the machine is physicaly on the testing grounds and everybody is lazy to go there each time. So basically it's like this:
- One logs in via ssh, obtaining session number (from 1 to a lot) and leaving own IP in an USER_START message.
- Does something as root, leaving own session number in every audit message.
- Logs out; or reboots the machine, so the session numbers would start again with 1 from this moment.
Basically, to track someones' IP you have to consider not only his session number, but login time as well. That might be cumbersome with multiple reboots, so naturally I have a feeling of doing something wrong.
Is there a proper way to determine ssh logged roots' original IP for every given auditd message?