0

I added the following lines to the /etc/audit/audit.rules file and restarted the machine:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Creating a user from the CLI using the useradd command records the following audit message:

Sep 28 15:44:09 HK-CentOS-7 useradd[4065] : new user: name= test1, UID= 38263, GID= 38263, home= / home/test1, shell= / bin/ bash

Creating a user from the GUI does not output the same user information like the above and it only mentions that the /etc/passwd file was written to. Are there any additional settings that I need to configure to enable more information to be generated from the GUI user creation? I would like to know exactly what user was created.

2
  • I'm not sure if it matters but what desktop manager are you using? Commented Sep 29, 2020 at 12:23
  • @MarkScheck I am using gdm.
    – Help
    Commented Sep 29, 2020 at 15:44

1 Answer 1

0

I think the answer lies here. Yast2 will be able to filter the journald logs 17.6 Using YaST to Filter the systemd Journal

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .