RE: P.S. - RE: [redhat-list] updates pending question

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



________________________________________
From: redhat-list-bounces@xxxxxxxxxx [redhat-list-bounces@xxxxxxxxxx] On Behalf Of m.roth@xxxxxxxxx [m.roth@xxxxxxxxx]
Sent: Friday, May 10, 2013 5:29 PM
To: General Red Hat Linux discussion list
Subject: RE: P.S. - RE: [redhat-list] updates pending question

Constance   Morris wrote:
> [mailto:redhat-list-bounces@xxxxxxxxxx] On Behalf Of m.roth@xxxxxxxxx
> Constance   Morris wrote:
>> [mailto:redhat-list-bounces@xxxxxxxxxx] On Behalf Of m.roth@xxxxxxxxx
<snip>
>> Nope. If auditd is running, that's all you need. If you see no
>> sealerts in /var/log/messages, or AVCs in /var/log/audit/audit.log, be
>> happy. The messages are for specific AVCs on *your* system, they're not
>> generic.
> <snip>
>> I do get AVC messages in the audit.log file  :
>> type=AVC msg=audit(1368211292.794:1593): avc:  denied  { search } for
>> pid=13587 comm="procmail" name="www" dev=dm-0 ino=3440923
>> scontext=system_u:system_r:procmail_t:s0
>> tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
>
> Ok, and that really did happen, since you're enforcing, not permissive.
> There should be a message in /var/log/messages with the kind of wording I
> posted, and it'll give you the command line for sealert.
>
> This is all I see in the /var/log/messages area for setroubleshoot......
>
> May 10 13:42:22 www yum: Installed: setroubleshoot-2.0.5-5.el5_8.1.noarch
> May 10 13:57:43 www setroubleshoot: [rpc.ERROR] attempt to open server
> connection failed: No such file or directory

That's odd - I haven't seen that one. I trust that service auditd status
shows it running. That's all I can think of.
>
> I really appreciate yours and Alfred's help and continued patience with
> me. I don't understand why this is so hard for me to fix and I'm sorry if
> I am being a pest.

No, you said you're just starting as an admin, and there's a lot to learn.
Trust me, the first system I was an admin on, back in the mid-nineties, I
was sleeping with the Fraesch Essential Systems Administration, as well as
my late wife; the upside was that when the corporate sysadmins were
brought in, almost a year later, my server was one of *two* that were
normal, out of 27 projects....

And back then, I didn't have to worry about selinux (bleah!).

      mark
-----------

Yep, I'm so new I just started last September and just when I think I've finally conquered one thing....I get hit with several fast curve balls.
Sounds like your sleepless nights paid off in the corporate arena.....one of two - very impressive.

Yes, I checked and service auditd status shows it is running. 

Constance

-- 
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list




[Index of Archives]     [CentOS]     [Kernel Development]     [PAM]     [Fedora Users]     [Red Hat Development]     [Big List of Linux Books]     [Linux Admin]     [Gimp]     [Asterisk PBX]     [Yosemite News]     [Red Hat Crash Utility]


  Powered by Linux