{"action":"created","issue":{"url":"https://api.github.com/repos/vmware/photon/issues/737","repository_url":"https://api.github.com/repos/vmware/photon","labels_url":"https://api.github.com/repos/vmware/photon/issues/737/labels{/name}","comments_url":"https://api.github.com/repos/vmware/photon/issues/737/comments","events_url":"https://api.github.com/repos/vmware/photon/issues/737/events","html_url":"https://github.com/vmware/photon/issues/737","id":294553945,"number":737,"title":"auid/loginuid not set","user":{"login":"UntilDoomsday","id":25139864,"avatar_url":"https://avatars3.githubusercontent.com/u/25139864?v=4","gravatar_id":"","url":"https://api.github.com/users/UntilDoomsday","html_url":"https://github.com/UntilDoomsday","followers_url":"https://api.github.com/users/UntilDoomsday/followers","following_url":"https://api.github.com/users/UntilDoomsday/following{/other_user}","gists_url":"https://api.github.com/users/UntilDoomsday/gists{/gist_id}","starred_url":"https://api.github.com/users/UntilDoomsday/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/UntilDoomsday/subscriptions","organizations_url":"https://api.github.com/users/UntilDoomsday/orgs","repos_url":"https://api.github.com/users/UntilDoomsday/repos","events_url":"https://api.github.com/users/UntilDoomsday/events{/privacy}","received_events_url":"https://api.github.com/users/UntilDoomsday/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-05T21:47:53Z","updated_at":"2018-02-08T20:41:40Z","closed_at":null,"author_association":"NONE","body":"Audit results show an auid of \"4294967295\" aka not set for all events. Using cat /proc/self/loginuid shows the same unset id.  I attempted to set the module in PAM to get this information but it did not work, so it appears other issues are not allowing it to work. Without the auid getting set I am unable to distinguish what user actually performed a task and this greatly reduces the ability to audit events.\r\n\r\nVersion: Full ISO 2.0 GA"},"comment":{"url":"https://api.github.com/repos/vmware/photon/issues/comments/364241769","html_url":"https://github.com/vmware/photon/issues/737#issuecomment-364241769","issue_url":"https://api.github.com/repos/vmware/photon/issues/737","id":364241769,"user":{"login":"UntilDoomsday","id":25139864,"avatar_url":"https://avatars3.githubusercontent.com/u/25139864?v=4","gravatar_id":"","url":"https://api.github.com/users/UntilDoomsday","html_url":"https://github.com/UntilDoomsday","followers_url":"https://api.github.com/users/UntilDoomsday/followers","following_url":"https://api.github.com/users/UntilDoomsday/following{/other_user}","gists_url":"https://api.github.com/users/UntilDoomsday/gists{/gist_id}","starred_url":"https://api.github.com/users/UntilDoomsday/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/UntilDoomsday/subscriptions","organizations_url":"https://api.github.com/users/UntilDoomsday/orgs","repos_url":"https://api.github.com/users/UntilDoomsday/repos","events_url":"https://api.github.com/users/UntilDoomsday/events{/privacy}","received_events_url":"https://api.github.com/users/UntilDoomsday/received_events","type":"User","site_admin":false},"created_at":"2018-02-08T20:41:40Z","updated_at":"2018-02-08T20:41:40Z","author_association":"NONE","body":"I was able to get the ID's set and represented correctly in the audit logs by adding \"session optional pam_loginuid.so\" to /etc/pam.d/sshd for ssh connections. The man page for pam_loginuid states:\r\n\r\nThe pam_loginuid module sets the loginuid process attribute for the process that was authenticated. This is necessary for applications to be correctly audited. This PAM module should only be used for entry point applications like: login, sshd, gdm, vsftpd, crond and atd.\r\n"}}
{"actor":{"display_login":"UntilDoomsday"}}