bm_rec

Untitled

Dec 21st, 2017
494
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 17.13 KB | None | 0 0
  1. type=CRYPTO_KEY_USER msg=audit(1513843910.690:3762): pid=10375 uid=0 auid=0 ses=99  msg='op=destroy kind=server fp=ed:c8:cd:d7:77:3b:d4:d1:94:a0:dd:4a:4f:44:dc:90 [MD5] direction=? spid=10375 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=pts/2 res=success'
  2. type=CRED_REFR msg=audit(1513843910.690:3763): pid=10375 uid=0 auid=0 ses=99  msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=dimon-w.lanit addr=172.30.126.43 terminal=ssh res=success'
  3. type=SERVICE_STOP msg=audit(1513844050.350:3764): pid=1 uid=0 auid=4294967295 ses=4294967295  msg=' comm="logstash" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
  4. type=SERVICE_START msg=audit(1513844050.350:3765): pid=1 uid=0 auid=4294967295 ses=4294967295  msg=' comm="logstash" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
  5. type=USER_AUTH msg=audit(1513844057.442:3766): pid=10477 uid=0 auid=0 ses=99  msg='op=PAM:authentication acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/2 res=success'
  6. type=USER_ACCT msg=audit(1513844057.442:3767): pid=10477 uid=0 auid=0 ses=99  msg='op=PAM:accounting acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/2 res=success'
  7. type=CRED_ACQ msg=audit(1513844057.446:3768): pid=10477 uid=0 auid=0 ses=99  msg='op=PAM:setcred acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/2 res=success'
  8. type=USER_START msg=audit(1513844057.446:3769): pid=10477 uid=0 auid=0 ses=99  msg='op=PAM:session_open acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/2 res=success'
  9. type=USER_ACCT msg=audit(1513844101.814:3770): pid=10546 uid=0 auid=4294967295 ses=4294967295  msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  10. type=CRED_ACQ msg=audit(1513844101.814:3771): pid=10546 uid=0 auid=4294967295 ses=4294967295  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  11. type=LOGIN msg=audit(1513844101.814:3772): pid=10546 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=100 res=1
  12. type=USER_START msg=audit(1513844101.822:3773): pid=10546 uid=0 auid=0 ses=100  msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  13. type=CRED_REFR msg=audit(1513844101.822:3774): pid=10546 uid=0 auid=0 ses=100  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  14. type=CRED_DISP msg=audit(1513844112.694:3775): pid=10546 uid=0 auid=0 ses=100  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  15. type=USER_END msg=audit(1513844112.698:3776): pid=10546 uid=0 auid=0 ses=100  msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  16. type=SERVICE_START msg=audit(1513844449.130:3777): pid=1 uid=0 auid=4294967295 ses=4294967295  msg=' comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
  17. type=SERVICE_STOP msg=audit(1513844449.130:3778): pid=1 uid=0 auid=4294967295 ses=4294967295  msg=' comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
  18. type=CRYPTO_SESSION msg=audit(1513844682.354:3779): pid=3703 uid=0 auid=0 ses=3  msg='op=start direction=from-client cipher=aes256-ctr ksize=256 spid=3703 suid=0 rport=49173 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  19. type=CRYPTO_SESSION msg=audit(1513844682.354:3780): pid=3703 uid=0 auid=0 ses=3  msg='op=start direction=from-server cipher=aes256-ctr ksize=256 spid=3703 suid=0 rport=49173 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  20. type=CRYPTO_KEY_USER msg=audit(1513844682.502:3781): pid=3703 uid=0 auid=0 ses=3  msg='op=destroy kind=session fp=? direction=from-client spid=3703 suid=0 rport=49173 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  21. type=CRYPTO_KEY_USER msg=audit(1513844682.642:3782): pid=3703 uid=0 auid=0 ses=3  msg='op=destroy kind=session fp=? direction=from-server spid=3703 suid=0 rport=49173 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  22. type=USER_ACCT msg=audit(1513845001.702:3783): pid=10742 uid=0 auid=4294967295 ses=4294967295  msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  23. type=CRED_ACQ msg=audit(1513845001.702:3784): pid=10742 uid=0 auid=4294967295 ses=4294967295  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  24. type=LOGIN msg=audit(1513845001.702:3785): pid=10742 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=101 res=1
  25. type=USER_START msg=audit(1513845001.706:3786): pid=10742 uid=0 auid=0 ses=101  msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  26. type=CRED_REFR msg=audit(1513845001.706:3787): pid=10742 uid=0 auid=0 ses=101  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  27. type=CRED_DISP msg=audit(1513845001.754:3788): pid=10742 uid=0 auid=0 ses=101  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  28. type=USER_END msg=audit(1513845001.758:3789): pid=10742 uid=0 auid=0 ses=101  msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  29. type=USER_ACCT msg=audit(1513845901.762:3790): pid=10810 uid=0 auid=4294967295 ses=4294967295  msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  30. type=CRED_ACQ msg=audit(1513845901.762:3791): pid=10810 uid=0 auid=4294967295 ses=4294967295  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  31. type=LOGIN msg=audit(1513845901.762:3792): pid=10810 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=102 res=1
  32. type=USER_START msg=audit(1513845901.766:3793): pid=10810 uid=0 auid=0 ses=102  msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  33. type=CRED_REFR msg=audit(1513845901.766:3794): pid=10810 uid=0 auid=0 ses=102  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  34. type=CRED_DISP msg=audit(1513845901.802:3795): pid=10810 uid=0 auid=0 ses=102  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  35. type=USER_END msg=audit(1513845901.806:3796): pid=10810 uid=0 auid=0 ses=102  msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  36. type=USER_ACCT msg=audit(1513846801.810:3797): pid=10853 uid=0 auid=4294967295 ses=4294967295  msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  37. type=CRED_ACQ msg=audit(1513846801.810:3798): pid=10853 uid=0 auid=4294967295 ses=4294967295  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  38. type=LOGIN msg=audit(1513846801.810:3799): pid=10853 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=103 res=1
  39. type=USER_START msg=audit(1513846801.814:3800): pid=10853 uid=0 auid=0 ses=103  msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  40. type=CRED_REFR msg=audit(1513846801.814:3801): pid=10853 uid=0 auid=0 ses=103  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  41. type=CRED_DISP msg=audit(1513846801.854:3802): pid=10853 uid=0 auid=0 ses=103  msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  42. type=USER_END msg=audit(1513846801.858:3803): pid=10853 uid=0 auid=0 ses=103  msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
  43. type=CRYPTO_SESSION msg=audit(1513847318.250:3804): pid=1550 uid=0 auid=0 ses=1  msg='op=start direction=from-client cipher=aes256-ctr ksize=256 spid=1550 suid=0 rport=65450 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  44. type=CRYPTO_SESSION msg=audit(1513847318.250:3805): pid=1550 uid=0 auid=0 ses=1  msg='op=start direction=from-server cipher=aes256-ctr ksize=256 spid=1550 suid=0 rport=65450 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  45. type=CRYPTO_KEY_USER msg=audit(1513847318.386:3806): pid=1550 uid=0 auid=0 ses=1  msg='op=destroy kind=session fp=? direction=from-client spid=1550 suid=0 rport=65450 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  46. type=CRYPTO_KEY_USER msg=audit(1513847318.526:3807): pid=1550 uid=0 auid=0 ses=1  msg='op=destroy kind=session fp=? direction=from-server spid=1550 suid=0 rport=65450 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  47. type=CRYPTO_SESSION msg=audit(1513847505.174:3808): pid=10370 uid=0 auid=0 ses=99  msg='op=start direction=from-client cipher=aes256-ctr ksize=256 spid=10370 suid=0 rport=51541 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  48. type=CRYPTO_SESSION msg=audit(1513847505.174:3809): pid=10370 uid=0 auid=0 ses=99  msg='op=start direction=from-server cipher=aes256-ctr ksize=256 spid=10370 suid=0 rport=51541 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  49. type=CRYPTO_KEY_USER msg=audit(1513847505.310:3810): pid=10370 uid=0 auid=0 ses=99  msg='op=destroy kind=session fp=? direction=from-client spid=10370 suid=0 rport=51541 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  50. type=CRYPTO_KEY_USER msg=audit(1513847505.450:3811): pid=10370 uid=0 auid=0 ses=99  msg='op=destroy kind=session fp=? direction=from-server spid=10370 suid=0 rport=51541 laddr=172.29.39.10 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
  51. type=CONFIG_CHANGE msg=audit(1513847662.074:3818): auid=0 ses=99 op="updated rules" path="/etc/passwd" key="identity" list=4 res=1
  52. type=SYSCALL msg=audit(1513847662.070:3819): arch=c000003e syscall=82 success=yes exit=0 a0=7ffc3d36d230 a1=7fd84a86f1a0 a2=7ffc3d36d1a0 a3=7ffc3d36ceb0 items=5 ppid=10478 pid=10925 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="useradd" exe="/usr/sbin/useradd" key="identity"
  53. type=CWD msg=audit(1513847662.070:3819):  cwd="/root"
  54. type=PATH msg=audit(1513847662.070:3819): item=0 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
  55. type=PATH msg=audit(1513847662.070:3819): item=1 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
  56. type=PATH msg=audit(1513847662.070:3819): item=2 name="/etc/passwd+" inode=12171279 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
  57. type=PATH msg=audit(1513847662.070:3819): item=3 name="/etc/passwd" inode=12122424 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
  58. type=PATH msg=audit(1513847662.070:3819): item=4 name="/etc/passwd" inode=12171279 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE
  59. type=CONFIG_CHANGE msg=audit(1513847662.074:3820): auid=0 ses=99 op="updated rules" path="/etc/shadow" key="identity" list=4 res=1
  60. type=SYSCALL msg=audit(1513847662.074:3821): arch=c000003e syscall=82 success=yes exit=0 a0=7ffc3d36d230 a1=7fd84a86f640 a2=7ffc3d36d1a0 a3=0 items=5 ppid=10478 pid=10925 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="useradd" exe="/usr/sbin/useradd" key="identity"
  61. type=CWD msg=audit(1513847662.074:3821):  cwd="/root"
  62. type=PATH msg=audit(1513847662.074:3821): item=0 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
  63. type=PATH msg=audit(1513847662.074:3821): item=1 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
  64. type=PATH msg=audit(1513847662.074:3821): item=2 name="/etc/shadow+" inode=12171280 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=DELETE
  65. type=PATH msg=audit(1513847662.074:3821): item=3 name="/etc/shadow" inode=12122425 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=DELETE
  66. type=PATH msg=audit(1513847662.074:3821): item=4 name="/etc/shadow" inode=12171280 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=CREATE
  67. type=USER_AUTH msg=audit(1513847671.818:3822): pid=10931 uid=0 auid=0 ses=99  msg='op=PAM:authentication acct="root" exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/2 res=success'
  68. type=USER_ACCT msg=audit(1513847671.818:3823): pid=10931 uid=0 auid=0 ses=99  msg='op=PAM:accounting acct="root" exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/2 res=success'
  69. type=USER_ACCT msg=audit(1513847671.842:3824): pid=10933 uid=0 auid=0 ses=99  msg='op=PAM:accounting acct="testuser" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
  70. type=CRED_ACQ msg=audit(1513847671.842:3825): pid=10933 uid=0 auid=0 ses=99  msg='op=PAM:setcred acct="testuser" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
  71. type=SYSCALL msg=audit(1513847671.858:3826): arch=c000003e syscall=2 success=yes exit=5 a0=7fc4ab49bd40 a1=20902 a2=0 a3=7ffe2300b1d0 items=1 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
  72. type=CWD msg=audit(1513847671.858:3826):  cwd="/root"
  73. type=PATH msg=audit(1513847671.858:3826): item=0 name="/etc/passwd" inode=12171279 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
  74. type=SYSCALL msg=audit(1513847671.858:3827): arch=c000003e syscall=2 success=yes exit=6 a0=7fc4ab49c1e0 a1=20902 a2=0 a3=0 items=1 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
  75. type=CWD msg=audit(1513847671.858:3827):  cwd="/root"
  76. type=PATH msg=audit(1513847671.858:3827): item=0 name="/etc/shadow" inode=12171280 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=NORMAL
  77. type=SYSCALL msg=audit(1513847671.858:3828): arch=c000003e syscall=2 success=yes exit=7 a0=7fc4ab49b8a0 a1=20902 a2=0 a3=0 items=1 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
  78. type=CWD msg=audit(1513847671.858:3828):  cwd="/root"
  79. type=PATH msg=audit(1513847671.858:3828): item=0 name="/etc/group" inode=105337 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
  80. type=DEL_USER msg=audit(1513847671.858:3829): pid=10931 uid=0 auid=0 ses=99  msg='op=deleting user entries id=1002 exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/2 res=success'
  81. type=CONFIG_CHANGE msg=audit(1513847671.878:3830): auid=0 ses=99 op="updated rules" path="/etc/passwd" key="identity" list=4 res=1
  82. type=SYSCALL msg=audit(1513847671.878:3831): arch=c000003e syscall=82 success=yes exit=0 a0=7ffe2300b010 a1=7fc4ab49bd40 a2=7ffe2300af80 a3=7ffe2300ac90 items=5 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
  83. type=CWD msg=audit(1513847671.878:3831):  cwd="/root"
  84. type=PATH msg=audit(1513847671.878:3831): item=0 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
  85. type=PATH msg=audit(1513847671.878:3831): item=1 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
  86. type=PATH msg=audit(1513847671.878:3831): item=2 name="/etc/passwd+" inode=12171284 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
  87. type=PATH msg=audit(1513847671.878:3831): item=3 name="/etc/passwd" inode=12171279 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
  88. type=PATH msg=audit(1513847671.878:3831): item=4 name="/etc/passwd" inode=12171284 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE
  89. type=CONFIG_CHANGE msg=audit(1513847671.894:3832): auid=0 ses=99 op="updated rules" path="/etc/shadow" key="identity" list=4 res=1
  90. type=SYSCALL msg=audit(1513847671.894:3833): arch=c000003e syscall=82 success=yes exit=0 a0=7ffe2300b010 a1=7fc4ab49c1e0 a2=7ffe2300af80 a3=4833555170593953 items=5 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
  91. type=CWD msg=audit(1513847671.894:3833):  cwd="/root"
  92. type=PATH msg=audit(1513847671.894:3833): item=0 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
  93. type=PATH msg=audit(1513847671.894:3833): item=1 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
  94. type=PATH msg=audit(1513847671.894:3833): item=2 name="/etc/shadow+" inode=12171285 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=DELETE
  95. type=PATH msg=audit(1513847671.894:3833): item=3 name="/etc/shadow" inode=12171280 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=DELETE
  96. type=PATH msg=audit(1513847671.894:3833): item=4 name="/etc/shadow" inode=12171285 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=CREATE
Advertisement
Add Comment
Please, Sign In to add comment