don't log cron events in auth.log

Question

In my /etc/rsyslog.conf, I have the following line to log the auth facility into /var/log/auth.log:

auth,authpriv.*           /var/log/auth.log

but the file is flooded with cron logs, such as these:

CRON[18620]:  pam_unix(cron:session): session opened for user root by (uid=0)
CRON[18620]:  pam_unix(cron:session): session closed for user root

I would like to get rid of the cron logs, and only have real "auth" events being logged into that file. By that I mean, I want to see which users have logged into the system, or made su -.

How can I achieve that?

Answer 1

If an attacker can control part of the message logged, they could mask events by filtering on the message contents.

Alternatively, you can filter out messages from the process CRON with:

#Continue logging CRON to syslog
*.*;auth,authpriv.none          -/var/log/syslog
#Filter events from the process CRON out of auth.log
:programname, isequal, "CRON" ~
auth,authpriv.*                 /var/log/auth.log

If you don't want any CRON events logged, you can put the filter line first in your rsyslog.conf.

Answer 2

I believe this is what you are looking for:

:msg, contains, "pam_unix(cron:session)" ~
auth,authpriv.* /var/log/auth.log

the first line matches cron auth events, and deletes them. The second line then logs as per your rule, minus the previously deleted lines.

Answer 3

For me this was the reason for misbehavior: https://languor.us/cron-pam-unix-cron-session-session-opened-closed-user-root-uid0

as stated here: https://askubuntu.com/a/280255/366528 adding this one line

session [success=1 default=ignore] pam_succeed_if.so service in cron quiet use_uid

removed those dummy cron-entries