New Users:
asterisk (104)
Deleted Users:
asterisk
New Groups:
asterisk (106)
Removed From Group:
user asterisk from group dialout
user asterisk from group audio
user asterisk from group dialout
user asterisk from group audio
Changed password expiry for users:
asterisk : 1 Time(s)
**Unmatched Entries**
userdel[29009]: removed group `asterisk' owned by `asterisk'
chfn[29164]: changed user `asterisk' information
gpasswd[29166]: set members of audio to asterisk
gpasswd[29168]: set members of dialout to asterisk
---------------------- Connections (secure-log) End -------------------------
The userdel has already been covered so could be ignored. I suspect the chfn is
password expirary change, so could be ignored. The group additions don't appear
to have been recorded, but probably should be.
Are you sure that the deletion of the group is covered? I only see
Deleted Users, not Deleted Groups in your report. I think this is
another spelling issue, the secure script contains the string "remove
group" instead of "removed group".
Concerning chfn: The manpage of chfn says "chfn changes user fullname,
office number, office extension, and home phone number information for a
user's account", so this seems to be different data. And it's changing a
root-owned file, so I'll add that too.
Can you send me the full loglines, so I can pass them to the script for
testing? You will find them in /var/log/auth.log.
Willi
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
