lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <817517.5859.qm@web36605.mail.mud.yahoo.com>
Date:	Thu, 7 Jun 2007 08:42:40 -0700 (PDT)
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Steve Grubb <sgrubb@...hat.com>,
	Jan Engelhardt <jengelh@...ux01.gwdg.de>
Cc:	Miloslav Trmac <mitr@...hat.com>, dwmw2@...radead.org,
	linux-kernel@...r.kernel.org, Alan Cox <alan@...hat.com>,
	Alexander Viro <aviro@...hat.com>
Subject: Re: [PATCH] Audit: Add TTY input auditing


--- Steve Grubb <sgrubb@...hat.com> wrote:

> On Thursday 07 June 2007 04:13:42 Jan Engelhardt wrote:
> > >Add TTY input auditing, used to audit system administrator's actions.
> >
> > _What_ exactly does it audit?
> 
> In theory, it should audit the actions performed by the sysadmin. This patch 
> doesn't cover actions done via X windows interface.
> 
> > And why does it only audit sysadmin actions?
> 
> This is what's called out for in various security standards such as NISPOM, 
> DCID 6/3, and PCI. Its all about non-repudiation.
> 
> > Is this supposed to be a keylogger?
> 
> Sort of. Its supposed to allow the Security Officer the ability to check on 
> what an admin was doing if they were found to be attempting access to 
> information outside their duties. Or if something is found to be 
> misconfigured, they can backtrack and see how it became that way if that was 
> important.
> 
> Some people try to be compliant with these security standards with user space
>  
> tools like rootsh, but that is too easy to detect and defeat. And then it 
> does not put its data into the audit system where its correlated with other 
> system events. 

The evaluation teams that I have worked with (OrangeBook and CC)
as well as their technical advisory groups have always been clear
that keyboard logging is not an appropriate mechanism for security
audit logging. There is insufficient correlation between what is
typed and security relevent actions for keyboard (or mouse event)
logging to meet the audit requirements. You have to log what happened.
Logging what was requested is insufficient and logging what was
typed, which may or may not have resulted in an actual request is
not helpful to meeting security audit requirements.

> >What about tty output?
> 
> That is not required.
> 
> -Steve
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 
> 
> 


Casey Schaufler
casey@...aufler-ca.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ