No utmp/wtmp logging for ssh on Redhat AS4 (CentOS 4) based VE.

Article ID: 1146 
Last Review: Oct,6 2008
Author: Vitaly Filatov
Last updated by: system APPLIES TO:
  • Parallels Virtuozzo Containers for Linux

Resolution

Users logged in a VE via ssh are not showing up in w/who commands.

This is related to PAM authentication. Virtuozzo kernel does not support audit.
sshd in Redhat AS4-u3 (CentOS 4.3) is trying to connect to kauditd socket using NETLINK.
This operation fails and thus sshd is not adding the record to utmp.
It is a bug in Redhat's patch to sshd.

As a workaround you may set the following settings in /etc/ssh/sshd_config:
UsePAM no
UseLogin yes


After that you need to restart sshd:
/etc/init.d/sshd restart

Keywords: w who audit ssh PAM authentication


Subscription for this article changesSubscription for this article changes

Please provide feedback on this article

Did this article help you solve your issue?
Yes
No
Partially
I do not know yet
 
Strongly Agree   Strongly Disagree
  9 8 7 6 5 4 3 2 1
The article is easy to understand
The article is accurate
Additional Comments:
*Please provide us with your email address in case we need to contact you.
* - required fields