Christoph_Lange
May 15, 2013Altostratus
radius authentication alert logging
I get a log entry, even though the user is properly authenticated - it's the same for ssh and http:
May 15 09:22:40 f5devicename alert httpd[12843]: pam_unix(httpd:account): could not identify user (from getpwnam(chris))
May 15 09:22:40 f5devicename notice httpd[12843]: pam_bigip_authz: authenticated user chris with role 0 (Administrator) in partition [All]
May 15 09:22:40 f5devicename notice httpd[12843]: 01070417:5: AUDIT - user chris - RAW: httpd(mod_auth_pam): user=chris(chris) partition=[All] level=Administrator tty=/usr/bin/tmsh host=10.10.10.5 attempts=1 start="Wed May 15 09:22:40 2013".
May 15 09:22:43 f5devicename notice httpd[12843]: 01070417:5: AUDIT - user chris - RAW: httpd(mod_auth_pam): user=chris(chris) partition=[All] level=Administrator tty=/usr/bin/tmsh host=10.10.10.5 attempts=1 start="Wed May 15 09:22:40 2013" end="Wed May 15 09:22:43 2013".
May 15 10:15:32 f5devicename alert sshd[7325]: pam_unix(sshd:account): could not identify user (from getpwnam(chris))
May 15 10:15:32 f5devicename notice sshd[7325]: pam_bigip_authz: authenticated user chris with role 0 (Administrator) in partition [All]
May 15 10:15:32 f5devicename info sshd(pam_audit)[7322]: user=chris(chris) partition=[All] level=Administrator tty=ssh host=10.10.10.24 attempts=1 start="Wed May 15 10:15:32 2013".
May 15 10:15:32 f5devicename info sshd(pam_audit)[7322]: 01070417:6: AUDIT - user chris - RAW: sshd(pam_audit): user=chris(chris) partition=[All] level=Administrator tty=ssh host=10.10.10.24 attempts=1 start="Wed May 15 10:15:32 2013".
May 15 10:15:37 f5devicename info sshd(pam_audit)[7322]: user=chris(chris) partition=[All] level=Administrator tty=ssh host=10.10.10.24 attempts=1 start="Wed May 15 10:15:32 2013" end="Wed May 15 10:15:37 2013".
May 15 10:15:37 f5devicename info sshd(pam_audit)[7322]: 01070417:6: AUDIT - user chris - RAW: sshd(pam_audit): user=chris(chris) partition=[All] level=Administrator tty=ssh host=10.10.10.24 attempts=1 start="Wed May 15 10:15:32 2013" end="Wed May 15 10:15:37 2013".
Is there any chance to avoid this?
br, chris