summaryrefslogtreecommitdiff
path: root/modules/pam_tty_audit/README
diff options
context:
space:
mode:
Diffstat (limited to 'modules/pam_tty_audit/README')
-rw-r--r--modules/pam_tty_audit/README51
1 files changed, 51 insertions, 0 deletions
diff --git a/modules/pam_tty_audit/README b/modules/pam_tty_audit/README
new file mode 100644
index 0000000..f769f53
--- /dev/null
+++ b/modules/pam_tty_audit/README
@@ -0,0 +1,51 @@
+pam_tty_audit — Enable or disable TTY auditing for specified users
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+DESCRIPTION
+
+The pam_tty_audit PAM module is used to enable or disable TTY auditing. By
+default, the kernel does not audit input on any TTY.
+
+OPTIONS
+
+disable=patterns
+
+ For each user matching one of comma-separated glob patterns, disable TTY
+ auditing. This overrides any previous enable option matching the same user
+ name on the command line.
+
+enable=patterns
+
+ For each user matching one of comma-separated glob patterns, enable TTY
+ auditing. This overrides any previous disable option matching the same user
+ name on the command line.
+
+open_only
+
+ Set the TTY audit flag when opening the session, but do not restore it when
+ closing the session. Using this option is necessary for some services that
+ don't fork() to run the authenticated session, such as sudo.
+
+NOTES
+
+When TTY auditing is enabled, it is inherited by all processes started by that
+user. In particular, daemons restarted by an user will still have TTY auditing
+enabled, and audit TTY input even by other users unless auditing for these
+users is explicitly disabled. Therefore, it is recommended to use disable=* as
+the first option for most daemons using PAM.
+
+To view the data that was logged by the kernel to audit use the command
+aureport --tty.
+
+EXAMPLES
+
+Audit all administrative actions.
+
+session required pam_tty_audit.so disable=* enable=root
+
+
+AUTHOR
+
+pam_tty_audit was written by Miloslav Trmač <mitr@redhat.com>.
+