I agree that SSH logging is sufficient. That was not the finding of our auditor, per best practices, blah blah. Thank SOX for that one. That must be one crue

I agree that SSH logging is sufficient. That was not the finding of our auditor, per best practices, blah blah. Thank SOX for that one. That must be one cruel god you have there... I don't have to _deal_ with it directly, just use it to authenticate logins on (most) of my unix servers. Seen from afar, it's not that bad. Now, she is a jealous god, as perceived by her acolytes. Nobody really wants to hear about how, during last year's DR testing at IBM, my stuff was up and running waaay before AD was working.