User administration auditing

Question

Hello,
My audit_control file and relevant class end event lines follows. But adding user and deleting user activities doesn't come audit.
what's wrong with it?
Thanks,
Osman
-bash-3.00# less /etc/security/audit_control
# Copyright (c) 1988 by Sun Microsystems, Inc.
# ident "@(#)audit_control.txt 1.4 00/07/17 SMI"
dir:/var/audit
flags: lo,ss,ua,as
#,ad,am,fc,fm,ua
naflags: lo,ss,ua,as
minfree:20
-bash-3.00# grep user /etc/security/audit_event
# 6144 - 32767 SunOS 5.X user level audit events
134:AUE_GETUSERAUDIT:getuseraudit(2):no
135:AUE_SETUSERAUDIT:setuseraudit(2):no
233:AUE_FUSERS:utssys(2) - fusers:fa
# user level audit events
6196:AUE_usermgr_add:add user/user attributes:ua
6197:AUE_usermgr_delete:delete user/user attributes:ua
6198:AUE_usermgr_modify:modify user/user attributes:ua
6207:AUE_create_user:create user:ua
6208:AUE_modify_user:modify user:ua
6209:AUE_delete_user:delete user:ua
6210:AUE_disable_user:disable user:ua
6211:AUE_enable_user:enable user:ua
-bash-3.00# grep user /etc/security/audit_class
0x00040000:ua:user administration

Answer 1

I too suffer from this. However I have another related concern.
I first noticed the original problem in Solaris 8 and overcame it as suggested by including exec events and parsing the results. It took a while but I got what I wanted - I needed exec events in any case to look for lp commands as well.
However in Solaris 10 8/07 I have noticed that the affected users are no longer recorded in useradd/userdel/usermod/passmgt events.
The output of praudit is simpler to parse because the variation in record lengths in reduced, but important information is missing, i.e the arguments of the commands are not included. Am I missing something?
For the record I normally adopt the following approach to 'optimise' the audit trail.
In /etc/security/audit_class I add several new masks. for example
0x01000000:za:My Admin
0x02000000:zf:My File
0x0f000000:zz:My All
Then in /etc/security/audit_event I add the za, zf etc to each line of interest.
In /etc/security/audit_control I have the line
flags:zz
Whilst this may be frowned upon, and may break in future if the masks I use come into play, I find that it makes life easier in that I can fine tune which events should be recorded and it is easier to identify the customisations when comparing different versions of the supplied files.
And for the record I have verified that without the above modifications the information I am seeking is still not present.
To test this, without modifications to audit_event and audit_class, and flags:all in audit_control
rm /var/audit/20*
svcadm enable auditd
useradd -u 1234 -g 1000 -d /tmp/user1 -s /bin/sh user1
passwd user1
passwd -l user1
passwd -d user1
userdel user1
svcadm disable auditd
auditreduce | praudit | grep user1The above returns just one line corresponding to the first passwd command.