[Bug 1948357] Re: sshd have no USER_LOGOUT audit event

[Launchpad Bug Tracker]

Status changed to 'Confirmed' because the bug affects multiple users.

** Changed in: openssh (Ubuntu)
       Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1948357

Title:
  sshd have no USER_LOGOUT audit event

Status in openssh package in Ubuntu:
  Confirmed

Bug description:
  ubuntu 18.04

  lizj at FNSTPC:~$ sudo aureport -e -i --summary | grep USER
  43241  USER_END
  16946  USER_START
  16718  USER_ACCT
  658  USER_AUTH
  543  USER_CMD
  255  USER_LOGIN
  9  USER_ROLE_CHANGE
  5  USER_ERR
  2  USER_CHAUTHTOK
  1  ADD_USER
  lizj at FNSTPC:~/.local/bin$ dpkg -l | grep openssh
  ii  openssh-client                                1:7.6p1-4ubuntu0.5                                  amd64        secure shell (SSH) client, for secure access to remote machines
  ii  openssh-server                                1:7.6p1-4ubuntu0.5                                  amd64        secure shell (SSH) server, for secure access from remote machines
  ii  openssh-sftp-server                           1:7.6p1-4ubuntu0.5                                  amd64        secure shell (SSH) sftp server module, for SFTP access from remote machines
  lizj at FNSTPC:~/.local/bin$ lsb_release -a
  No LSB modules are available.
  Distributor ID:	Ubuntu
  Description:	Ubuntu 18.04.6 LTS
  Release:	18.04
  Codename:	bionic

  
  while in my fedora 33 host, it includes USER_LOGOUT as below

  fedora 33
  [root at iaas-rpma linux]# aureport -e -i --summary | grep USER
  7356  CRYPTO_KEY_USER
  2103  USER_START
  1649  USER_END
  1268  USER_ACCT
  1108  USER_ROLE_CHANGE
  1029  USER_AUTH
  895  USER_LOGIN
  789  USER_LOGOUT
  60  USER_CMD
  14  USER_ERR
  3  USER_MGMT
  3  USER_CHAUTHTOK
  1  ADD_USER
  [root at iaas-rpma ~]# rpm -qa | grep openssh
  openssh-8.4p1-1.1.fc33.x86_64
  openssh-clients-8.4p1-1.1.fc33.x86_64
  openssh-server-8.4p1-1.1.fc33.x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1948357/+subscriptions