LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Closed Thread
  Search this Thread
Old 05-19-2008, 07:55 AM   #1
mccartjd
Member
 
Registered: Apr 2008
Posts: 108

Rep: Reputation: 15
Unhappy RHEL 4: WS 64bit - LAUS is not loaded by default can not find RPM


Can anyone tell me where I can find the RPM that installs LAUS? I've search all the CDs looking for apparent names and even read CD 1 and CD 2 but nothing jumps out and tells me where I can find the LAUS application bundled in a RPM.

A million thanks
John
 
Old 05-19-2008, 08:47 AM   #2
mccartjd
Member
 
Registered: Apr 2008
Posts: 108

Original Poster
Rep: Reputation: 15
Disc 9 has audit-0.5.src.rpm. Can anyone tell me if this is LAuS?
 
Old 05-19-2008, 08:57 AM   #3
mccartjd
Member
 
Registered: Apr 2008
Posts: 108

Original Poster
Rep: Reputation: 15
Sorry ment to say audit-0.5-1.src.rpm.
 
Old 05-19-2008, 10:19 AM   #4
mccartjd
Member
 
Registered: Apr 2008
Posts: 108

Original Poster
Rep: Reputation: 15
I found auditd and auditctl in by /sbin, do these files encompass LAuS and all I need to do is launch the executeables, I was told by someone that auditd is LAuS hmm.
 
Old 05-19-2008, 01:02 PM   #5
mccartjd
Member
 
Registered: Apr 2008
Posts: 108

Original Poster
Rep: Reputation: 15
Unhappy Result of rpm -qa | grep audit are audit-0.5-1

On RHEL 4 WS disk 2 performed a rpm -qlvp *audit to see what this rpm (audit-0.5-1.x86_64.rpm) included, all it said was auditd and auditctl will be placed in your /sbin.

These files are already loaced in /sbin. I'm lost at this point. I dont have a audit.conf file or audit-libs files. I know I'm making this harder than what it probably is but urg!

auditd is running with a processes when I type chkconfig auditd while in the /sbin directory, when I logout thought I think the PID is killed.

Help, simply trying to use the auditd utility and veiw the logs with the LINUX GUI interface.
 
Old 05-19-2008, 04:04 PM   #6
mccartjd
Member
 
Registered: Apr 2008
Posts: 108

Original Poster
Rep: Reputation: 15
No audit.rule file

Ok,

I was told I would have a etc/audit.rules file, no such files nor a var/log/audit/audit.log file. I have no audit-libs files or audit.conf file. Any ideas; is this a partial install of the auditd capability?

http://www.redhat.com/docs/manuals/e...-s390x-en.html

The site above does not imply I have to do much and it should work the second I invokde auditd however, many of the assumed files and directories were not on my linux RHEL 4 WS 64 bit 2.6.9-5.Elsmp system.
 
Old 05-19-2008, 09:05 PM   #7
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
This part of the thread should really be in a thread of its own in the Linux Security forum since it appears you're past installing your software...


Quote:
Originally Posted by mccartjd View Post
These files are already loaced in /sbin.
Then 'rpm -qf /sbin/auditd' should show the name and version of the package.


Quote:
Originally Posted by mccartjd View Post
I dont have a audit.conf file or audit-libs files.
What does 'rpm -ql audit' say?


Quote:
Originally Posted by mccartjd View Post
I was told I would have a etc/audit.rules file, no such files nor a var/log/audit/audit.log file. I have no audit-libs files or audit.conf file. Any ideas; is this a partial install of the auditd capability?
To be correct it's /etc/audit/audit.rules. No /var/log/audit/ dir? audit-libs is for apps to log auditing info. Running 'rpm -q --whatrequires audit-libs' shows audit, shadow-utils, passwd, pam, util-linux, openssh and nscd.


Quote:
Originally Posted by mccartjd View Post
The site above does not imply I have to do much and it should work the second I invokde auditd however, many of the assumed files and directories were not on my linux RHEL 4 WS 64 bit 2.6.9-5.Elsmp system.
No, you shouldn't have to do much. But from reading your threads I don't know yet if it's actually GNU/Linux itself you're struggling with or a bad or partial OS/audit installation. Answer some questions and we'll see. Please be exact in your answers please.


* BTW, what dictates or requires you to use Auditd? Just being curious.
 
Old 05-20-2008, 07:53 AM   #8
mccartjd
Member
 
Registered: Apr 2008
Posts: 108

Original Poster
Rep: Reputation: 15
Then 'rpm -qf /sbin/auditd' should show the name and version of the package.
Answer: audit-0.5-1




What does 'rpm -ql audit' say?
Answer: sbin/auditctl
sbin/auditd



To be correct it's /etc/audit/audit.rules. No /var/log/audit/ dir? audit-libs is for apps to log auditing info. Running 'rpm -q --whatrequires audit-libs' shows audit, shadow-utils, passwd, pam, util-linux, openssh and nscd.

Typed command rpm -q --whatrequires audit-libs
Answer: no package requires audit-libs "If I leave the ' after libs I get a blank line
that starts with a >"
 
Old 05-20-2008, 08:46 AM   #9
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
Determine if business or other requirements allow you add CentOS packages to your RHEL installation. Else take the most recent CentOS-4 audit.* source packages (IIRC it should be up to U8 now?) and rebuild for your machine.
 
Old 05-20-2008, 09:24 AM   #10
mccartjd
Member
 
Registered: Apr 2008
Posts: 108

Original Poster
Rep: Reputation: 15
Smile Last Resort SNARE

In your opion which would be quicker on my standalone LINUX?

(1) Load SNARE

(2) add CentOS packages to your RHEL installation.

(4) CentOS-4 audit.* source packages (IIRC it should be up to U8 now?) and rebuild for your machine.

FYI. Really new with LINUX and never performed a rebuild.
Can not seem to add auditd to services to remain active after I root logs out "chkconfig --add auditd" or "chkconfig --add /sbin/auditd" results in "error reading information on service auditd: no such file or directory. If I type "chkconfig auditd" I get no errors and if I type "auditd" I get a PID #. If auditd is not running after root logs out SNARE will probaly not work (your thoughts)?
 
Old 05-21-2008, 08:44 AM   #11
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
Quote:
Originally Posted by mccartjd View Post
your thoughts)?
Even after consolidation you have three threads rolling about the same subject. Keeping things together is not only more efficient for you but also keeps your fellow LQ members from posting duplicate replies. I suggest you continue discussing SNARE, Auditd and rules here http://www.linuxquestions.org/questi...snare.-642459/.
 
  


Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Installing Ruby on RHEL 4 64bit Neruocomp Linux - Software 2 09-26-2012 06:43 PM
RHEL 4 - Auditing, LAuS, SNARE. mccartjd Linux - Security 12 01-26-2009 05:24 PM
RHEL 4 64bit Workstation mccartjd Linux - Newbie 3 05-06-2008 07:26 PM
RHEL 4 hangs on AMD 64bit PC sushil_gambhir Red Hat 2 06-09-2006 12:18 AM
RHEL 3 update 5 with LAuS in XWindows?? Lan_61 Linux - Enterprise 0 10-03-2005 10:45 AM


All times are GMT -5. The time now is 04:37 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration