audit to log suspicious user actions on a workstation in my institution. I found that, in addition to logging to
auditd also writes to
/var/log/messages. Consequently, unprivileged user can view the logged record simply by typing the
dmesg command. This greatly affects user privacy.
I've also tried this: writing
:programname, isequal, "audit" ~ to
rsyslog.conf, but it did not work for me.
Some also suggest adding
audit=0 to kernel parameter. I'm not sure if it shall disable
auditd completely. Furthermore, the workstations have many active users and should not be rebooted.
Anyone have a clue?
Thanks in advance!
OS: Debian Testing auditctl version: 2.4.5