pam_tty_audit.so [
disable=patterns
] [
enable=patterns
]
The pam_tty_audit PAM module is used to enable or disable TTY auditing. By default, the kernel does not audit input on any TTY.
For each user matching patternsenable
option matching the same user name on the command line. See NOTES
for further description of patterns
For each user matching patternsdisable
option matching the same user name on the command line. See NOTES
for further description of patterns
Set the TTY audit flag when opening the session, but do not restore
it when closing the session. Using this option is necessary for
some services that don't fork() to run the
authenticated session, such as sudo.
Log keystrokes when ECHO mode is off but ICANON mode is active. This is the mode in which the tty is placed during password entry. By default, passwords are not logged. This option may not be available on older kernels (3.9?).
Error reading or modifying the TTY audit flag. See the system log for more details.
Success.
When TTY auditing is enabled, it is inherited by all processes started by
that user. In particular, daemons restarted by a user will still have
TTY auditing enabled, and audit TTY input even by other users unless
auditing for these users is explicitly disabled. Therefore, it is
recommended to use disable=* as the first option for
most daemons using PAM.
To view the data that was logged by the kernel to audit use the command aureport --tty.
The patternsmin_uid:max_uid where
one of these values can be empty. If min_uid is
empty only user with the uid max_uid will be
matched. If max_uid is empty users with the uid
greater than or equal to min_uid will be
matched.
Please note that passwords in some circumstances may be logged by TTY auditing
even if the log_passwd is not used. For example, all input to
an ssh session will be logged - even if there is a password being typed into
some software running at the remote host because only the local TTY state
affects the local TTY auditing.
Audit all administrative actions.
session required pam_tty_audit.so disable=* enable=root