Re: New rules for su root attempts

On Wednesday 23 July 2008 07:06:13 Yoann Vandoorselaere wrote:
> > I've found that performing 'su - root' task generates no events from
> > prelude-lml sensor on FreeBSD systems. So I added two rules for
> > successfull and non-successfull attempts. I'm not sure what *.rules
> > should be updated (pam.rules or other), so I placed them into su.rules
> > file.
>
> Before including the rules in Prelude-LML, I'd suggest making the
> following modification:
>
> - Use the same classification as PAM (ie: User Authentication).

Well, su actually has 2 operations, user authentication and change of 
credentials that may include new rights via ancilliary groups and of course 
capabilities if root. It is possible to have the correct password, but yet be 
denied by pam.

So it would seem to me that you would want any failure in the password to be 
logged as an auth failure, but you would want anything else to be recorded as 
a change in credentials.


> - Match on any user (not only root).

root is the one called out for in many security targets because its a granting 
of capabilities.

There is also a spelling correction needed for successfully.

-Steve
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel