Articles

RHEL6 auditing

If you want to monitor all actions on your servers, even those from root, there's a pretty straightforward and easy solution on RHEL6. Let's first analyze the different approaches:You can use pam_tty_audit to send all keystrokes to /var/log/audit/audit.log…