Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 368

Example 30.8, "An Advanced Audit Event—Login via SSH"
audit events triggered by an incoming SSH connection. Most of the messages are related
to the PAM stack and reflect the different stages of the SSH PAM process. Several of
the audit messages carry nested PAM messages in them that signify that a particular
stage of the PAM process has been reached. Although the PAM messages are logged
by audit, audit assigns its own message type to each event:
Example 30.8 An Advanced Audit Event—Login via SSH
type=USER_AUTH msg=audit(1234877011.791:7731): user pid=26127 uid=0
auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="root"
exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=ssh res=success)'
type=USER_ACCT msg=audit(1234877011.795:7732): user pid=26127 uid=0
auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root"
exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=ssh res=success)'
type=CRED_ACQ msg=audit(1234877011.799:7733): user pid=26125 uid=0
auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root"
exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=/dev/pts/0
res=success)'
type=LOGIN msg=audit(1234877011.799:7734): login pid=26125 uid=0
old auid=4294967295 new auid=0 old ses=4294967295 new ses=1172
type=USER_START msg=audit(1234877011.799:7735): user pid=26125 uid=0
auid=0 ses=1172 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=/dev/pts/0
res=success)'
type=USER_LOGIN msg=audit(1234877011.823:7736): user pid=26128 uid=0
auid=0 ses=1172 msg='uid=0: exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=/dev/pts/0
res=success)'
type=CRED_REFR msg=audit(1234877011.828:7737): user pid=26128 uid=0
auid=0 ses=1172 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd"
(hostname=jupiter.example.com, addr=192.168.2.100, terminal=/dev/pts/0
res=success)'
PAM reports that is has successfully requested user authentication for root from
a remote host (jupiter.example.com, 192.168.2.100). The terminal where this is
happening is ssh.
PAM reports that it has successfully determined whether the user is authorized to
log in at all.
PAM reports that the appropriate credentials to log in have been acquired and that
the terminal changed to a normal terminal (/dev/pts0).
356 Security Guide
(page 356) highlights the