URL: <http://savannah.gnu.org/bugs/?39712>
Summary: su actions not properly logged Project: GNU Screen Submitted by: None Submitted on: Wed 07 Aug 2013 03:24:34 AM UTC Category: None Severity: 3 - Normal Priority: 5 - Normal Status: None Privacy: Public Assigned to: None Open/Closed: Open Discussion Lock: Any Release: 4.0.3 Fixed Release: None Planned Release: None Work Required: None _______________________________________________________ Details: We're seeing an issue where su actions are not properly recorded when the user is in a screen session. What's interesting is that this appears to work properly on Ubuntu 12.04.2 running screen 4.00.03jw4 (FAU) 2-May-06 but does not work correctly on CentOS 6.04 running screen (FAU) 23-Oct-06. So maybe this is packaging related, but thought we'd start here. When a user in a scree session runs "sudo su" the following appears in the Ubuntu logs: Aug 6 16:26:06 delta sudo: chrish : TTY=pts/5 ; PWD=/home/chrish ; USER=root ; COMMAND=/bin/su Aug 6 16:26:06 delta sudo: pam_unix(sudo:session): session opened for user root by chrish(uid=1000) Aug 6 16:26:06 delta su[27840]: Successful su for root by root Aug 6 16:26:06 delta su[27840]: + /dev/pts/5 root:root Aug 6 16:26:06 delta su[27840]: pam_unix(su:session): session opened for user root by chrish(uid=0) Aug 6 16:26:19 delta su[27840]: pam_unix(su:session): session closed for user root Aug 6 16:26:19 delta sudo: pam_unix(sudo:session): session closed for user root In the CentOS log we get: Aug 6 16:38:03 epsilon sudo: chrish : TTY=pts/8 ; PWD=/home/chrish ; USER=root ; COMMAND=/bin/su Aug 6 16:38:03 epsilon su: pam_unix(su:session): session opened for user root by (uid=0) Aug 6 16:38:04 epsilon su: pam_unix(su:session): session closed for user root Notice that the second line does not indicate the name of the user which performed the sudo like we do in Ubuntu. Without this data, our logs are incomplete and log monitoring utilities do not properly fire. Possible this is related to packaging or another part of the OS, possibly PAM? Additional notes, includes showing that it does not work in tmux on either OS, are available here: https://gist.github.com/chrishas35/972fc8febad14bad1ae4. _______________________________________________________ Reply to this item at: <http://savannah.gnu.org/bugs/?39712> _______________________________________________ Message sent via/by Savannah http://savannah.gnu.org/