0

Linux 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux auditd-2.6.7-2 amd64

There's user (user1 - auid=1002) - ssh account (SSH tunnel for remote MySQL connections). I need exclude it's activity from logging via auditd. Next rules were written:

cat /etc/audit/rules.d/audit.rules

-D
-b 8192
-f 1
--backlog_wait_time 0
-a never,user -F subj_type=crond_t
-a exit,never -F subj_type=crond_t
-a exit,never -F auid=1002

# Also tried next variants:
#-a exit,never -F auid!=1002
#-a exit,never -F auid=1002 -F uid=0
#-a exit,never -F auid=1002 exe="/usr/sbin/sshd"
# other variants based on msgtype, ouid, auid, uid...

But with no effect. Logging still continues:

type=USER_AUTH msg=audit(1548826708.780:5112732): pid=28576 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

type=USER_ACCT msg=audit(1548826708.780:5112733): pid=28576 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

type=CRED_ACQ msg=audit(1548826708.780:5112734): pid=28576 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

type=LOGIN msg=audit(1548826708.780:5112735): pid=28576 uid=0 old-auid=4294967295 auid=1002 tty=(none) old-ses=4294967295 ses=10931 res=1

type=USER_START msg=audit(1548826708.792:5112736): pid=28576 uid=0 auid=1002 ses=10931 msg='op=PAM:session_open acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

type=CRED_ACQ msg=audit(1548826708.796:5112737): pid=28583 uid=0 auid=1002 ses=10931 msg='op=PAM:setcred acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

type=USER_AUTH msg=audit(1548826730.980:5112738): pid=28720 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

type=USER_ACCT msg=audit(1548826730.980:5112739): pid=28720 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

type=CRED_ACQ msg=audit(1548826730.980:5112740): pid=28720 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

type=LOGIN msg=audit(1548826730.980:5112741): pid=28720 uid=0 old-auid=4294967295 auid=1002 tty=(none) old-ses=4294967295 ses=10932 res=1

type=USER_START msg=audit(1548826730.992:5112742): pid=28720 uid=0 auid=1002 ses=10932 msg='op=PAM:session_open acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

type=CRED_ACQ msg=audit(1548826730.992:5112743): pid=28726 uid=0 auid=1002 ses=10932 msg='op=PAM:setcred acct="user1" exe="/usr/sbin/sshd" hostname=10.40.0.66 addr=10.40.0.66 terminal=ssh res=success'

How can I filter audit logs for certain ssh users?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.