This bug was fixed in the package openssh - 1:6.9p1-2
---------------
openssh (1:6.9p1-2) unstable; urgency=medium
[ Colin Watson ]
* mention-ssh-keygen-on-keychange.patch: Move example ssh-keygen
invocation onto a separate line to make it easier to copy and paste
(LP: #1491532).
[ Tyler Hicks ]
* Build with audit support on Linux (closes: #797727, LP: #1478087).
-- Colin Watson <cjwat...@debian.org> Thu, 10 Sep 2015 12:26:11 +0100
** Changed in: openssh (Ubuntu Wily)
Status: Triaged => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to audit in Ubuntu.
https://bugs.launchpad.net/bugs/1478087
Title:
ISST-LTE: aureport -l couldn't print out login info on ubuntu 14.04.3
Status in audit package in Ubuntu:
Invalid
Status in lightdm package in Ubuntu:
Triaged
Status in openssh package in Ubuntu:
Fix Released
Status in shadow package in Ubuntu:
Fix Released
Status in lightdm source package in Trusty:
Triaged
Status in openssh source package in Trusty:
Triaged
Status in shadow source package in Trusty:
Triaged
Status in lightdm source package in Vivid:
Triaged
Status in openssh source package in Vivid:
Triaged
Status in shadow source package in Vivid:
Triaged
Status in lightdm source package in Wily:
Triaged
Status in openssh source package in Wily:
Fix Released
Status in shadow source package in Wily:
Fix Released
Bug description:
-- Problem Description --
We installed ubuntu 14.04.3 on lakelp1 and installed package auditd. We tried
to
ssh to lakelp1 several times and found that "aureport -l" couldn't print out
the login
info.
root@lakelp1:~# /etc/init.d/auditd status
* auditd is running.
root@lakelp1:~# auditctl -e 1
AUDIT_STATUS: enabled=1 flag=1 pid=38784 rate_limit=0 backlog_limit=320
lost=12 backlog=1
root@lakelp1:~# grep -i login /var/log/audit/audit.log
type=LOGIN msg=audit(1437641256.987:67): pid=11752 uid=0 old-auid=4294967295
auid=0 old-ses=4294967295 ses=4 res=1
type=LOGIN msg=audit(1437642646.478:85): pid=44269 uid=0 old-auid=4294967295
auid=0 old-ses=4294967295 ses=5 res=1
type=LOGIN msg=audit(1437642700.295:90): pid=21504 uid=0 old-auid=4294967295
auid=0 old-ses=4294967295 ses=6 res=1
type=LOGIN msg=audit(1437642765.339:104): pid=16628 uid=0 old-auid=4294967295
auid=0 old-ses=4294967295 ses=7 res=1
type=LOGIN msg=audit(1437644638.593:130): pid=44443 uid=0 old-auid=4294967295
auid=0 old-ses=4294967295 ses=8 res=1
root@lakelp1:~# aureport -l
Login Report
============================================
# date time auid host term exe success event
============================================
<no events of interest were found>
This looks like a bug in aureport or libaudit. In addition to giving
admins falsely empty record selections, this would prevent successful
completion of a Common Criteria certification.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/audit/+bug/1478087/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
