topic Re: auditing ssh and Xwindows in Operating System - HP-UX

auditing ssh and Xwindows

Jason Mackanick_4 — Wed, 20 Jul 2005 04:11:07 GMT

I am trying to use a trusted system to audit ssh logins. I found that I had to set UseLogin to yes in the sshd_config. When I do this, the X11 port forwarding does not work with ssh anymore. Any suggestions to fix this?

Re: auditing ssh and Xwindows

Kasper Hedensted — Wed, 20 Jul 2005 04:48:46 GMT

Hi Jason,

Yes X11 port forwarding is disabled when UseLogin is set to yes. From sshd_config manpage:

X11Forwarding will be disabled because login(1) does not know how to handle xauth(1) cookies

I haven't tried this but take a look at this site:
http://www.mayoxide.com/audenable/

Cheers,
Kasper

Re: auditing ssh and Xwindows

Jason Mackanick_4 — Wed, 20 Jul 2005 04:57:47 GMT

Are there any other ways to have the trusted auditing work correctly without utilizing the UseLogin feature?

Re: auditing ssh and Xwindows

Kasper Hedensted — Wed, 20 Jul 2005 07:03:24 GMT

I am not aware of this (I haven't used auditing that much)

But you can set ssh to log logins to syslog (This might be default)