- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
Check Point's Cyber Park is Now Open
Let the Games Begin!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hello, everyone!
Does anybody successfully configured audit-daemon at CP with module `pam_tty_audit.so`? The module`pam_tty_audit.so` doesn't exist in a standard package of CP but it exists in standard CentOS and RHEL editions.
I want to log and audit all characters passed into the console\tty from expert and clish shells. Existed audit methods in clish are not satisfied with me. Maybe someone knows the best decision for this task?
If you want support for pam_tty_audit.so, an RFE will likely be required.
Specific commands entered via clish and expert shell can be logged, but not “all characters passed.”
Existing audit methods (clish and expert-mode) don't log all passed commands. There are many flows that can give you unlogged command execution. The same fault may be caused if you try to log commands with profile's *.rc files. I think that the only proper solution is audit with the pam-module, isn't it?
Don’t know enough about how pam_tty_audit.so works to comment.
That said, an RFE would be needed.
You may also want to engage your local Check Point office with your precise requirements.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY