2

I'm on Ubuntu 16.04 and I'm trying to stop /var/auth.log being flooded by a script that checks if some hosts are alive on the network periodically. The script internally uses sudo with nmap.

I have this in my /etc/pam.d/sudo file:

#%PAM-1.0

session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0 ruser = deployer
session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0

session    required   pam_env.so readenv=1 user_readenv=0
session    required   pam_env.so readenv=1 envfile=/etc/default/locale user_readenv=0
@include common-auth
@include common-account
@include common-session-noninteractive

session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0 ruser = deployer
session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0

However, I am still seeing this in /var/log/auth.log:

Dec  1 10:27:43 TimeBox sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Dec  1 10:27:44 TimeBox sudo: deployer : TTY=unknown ; PWD=/data/deployer/timeagent ; USER=root ; COMMAND=/usr/bin/nmap -sn -PR -n -v0 -oX /tmp/nmap.xml20161201-5387-rn90pj 192.168.88.16
Dec  1 10:27:44 TimeBox sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Dec  1 10:27:44 TimeBox sudo: deployer : TTY=unknown ; PWD=/data/deployer/timeagent ; USER=root ; COMMAND=/usr/bin/nmap -sn -PR -n -v0 -oX /tmp/nmap.xml20161201-5387-dni0n5 192.168.88.20
Dec  1 10:27:44 TimeBox sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Dec  1 10:27:44 TimeBox sudo: deployer : TTY=unknown ; PWD=/data/deployer/timeagent ; USER=root ; COMMAND=/usr/bin/nmap -sn -PR -n -v0 -oX /tmp/nmap.xml20161201-5387-1vk93k7 192.168.88.19
Dec  1 10:27:44 TimeBox sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Dec  1 10:27:44 TimeBox sudo: deployer : TTY=unknown ; PWD=/data/deployer/timeagent ; USER=root ; COMMAND=/usr/bin/nmap -sn -PR -n -v0 -oX /tmp/nmap.xml20161201-5387-j4hcxl 192.168.88.21
Dec  1 10:27:44 TimeBox sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Dec  1 10:27:44 TimeBox sudo: deployer : TTY=unknown ; PWD=/data/deployer/timeagent ; USER=root ; COMMAND=/usr/bin/nmap -sn -PR -n -v0 -oX /tmp/nmap.xml20161201-5387-6krabn 192.168.88.13

Any ideas what I'm doing wrong?

  • You are checking too many time (per second) if the site is alive. I would also change the logic of checking (why need to log for checking?). Note the flood is not only on auth.log, but also on other logs. – Giacomo Catenazzi Dec 1 '16 at 10:36
  • The flood is just on auth.log and I am not checking too many times, they are all different IPs. – Roman Gaufman Dec 1 '16 at 10:46
2

It seems the issue was with @include common-session-noninteractive - this works for me in /etc/pam.d/sudo:

  #%PAM-1.0

  session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0 ruser = deployer
  session    required   pam_env.so readenv=1 user_readenv=0
  session    required   pam_env.so readenv=1 envfile=/etc/default/locale user_readenv=0

  @include common-auth
  @include common-account
  # @include common-session-noninteractive

And I also created /etc/rsyslog.d/35-pam_unix.conf to prevent the logging of the actual sudo line:

if $syslogtag contains 'sudo' and $msg contains '/data/deployer/timeagent' then ~
0

You 3 choices:

  • run nmap as root
  • do a filter regex at syslog level
  • modify source

The 1st one is the recommended way.

  • 1) All scripts run as the deployer user 2) I can do, but there is a way to handle this in /etc/pam.d/cron, I just didn't get the syntax right 3) There is be a way to handle this in /etc/pam.d/cron without modifying the source – Roman Gaufman Dec 1 '16 at 10:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.