# pam_tty_audit

## NAME



           pam_tty_audit - Enable or disable TTY auditing for specified users
    


## SYNOPSIS



    
           **pam_tty_audit.so**[disable=_patterns_] [enable=_patterns_]
    


## DESCRIPTION



           The pam_tty_audit PAM module is used to enable or disable TTY
           auditing. By default, the kernel does not audit input on any TTY.
    


## OPTIONS



           **disable=**_patterns_
               For each user matching _patterns_ , disable TTY auditing. This
               overrides any previous **enable** option matching the same user
               name on the command line. See NOTES for further description of
               _patterns_.
    
           **enable=**_patterns_
               For each user matching _patterns_ , enable TTY auditing. This
               overrides any previous **disable** option matching the same user
               name on the command line. See NOTES for further description of
               _patterns_.
    
           **open_only**
               Set the TTY audit flag when opening the session, but do not
               restore it when closing the session. Using this option is
               necessary for some services that don't **fork()** to run the
               authenticated session, such as **sudo**.
    
           **log_passwd**
               Log keystrokes when ECHO mode is off but ICANON mode is
               active. This is the mode in which the tty is placed during
               password entry. By default, passwords are not logged. This
               option may not be available on older kernels (3.9?).
    


## MODULE TYPES PROVIDED



           Only the **session** type is supported.
    


## RETURN VALUES



           PAM_SESSION_ERR
               Error reading or modifying the TTY audit flag. See the system
               log for more details.
    
           PAM_SUCCESS
               Success.
    


## NOTES



           When TTY auditing is enabled, it is inherited by all processes
           started by that user. In particular, daemons restarted by a user
           will still have TTY auditing enabled, and audit TTY input even by
           other users unless auditing for these users is explicitly
           disabled. Therefore, it is recommended to use **disable=*** as the
           first option for most daemons using PAM.
    
           To view the data that was logged by the kernel to audit use the
           command **aureport --tty**.
    
           The _patterns_ are comma separated lists of glob patterns or ranges
           of uids. A range is specified as _min_uid_ :_max_uid_ where one of
           these values can be empty. If _min_uid_ is empty only user with the
           uid _max_uid_ will be matched. If _max_uid_ is empty users with the
           uid greater than or equal to _min_uid_ will be matched.
    
           Please note that passwords in some circumstances may be logged by
           TTY auditing even if the **log_passwd** is not used. For example, all
           input to an ssh session will be logged - even if there is a
           password being typed into some software running at the remote host
           because only the local TTY state affects the local TTY auditing.
    


## EXAMPLES



           Audit all administrative actions.
    
               session   required pam_tty_audit.so disable=* enable=root
    


* * *