Bug 244613

Summary:	sys-apps/logwatch prints wrong issuer uid of "su" invocations
Product:	Gentoo Linux	Reporter:	Adam Gergely <admin>
Component:	New packages	Assignee:	Gentoo's Team for Core System packages <base-system>
Status:	RESOLVED FIXED
Severity:	major	CC:	asganquietas, hoffie
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://forums.gentoo.org/viewtopic-t-709953.html
Whiteboard:
Package list:		Runtime testing required:	---

Description Adam Gergely 2008-10-27 10:55:40 UTC

The problem is here: http://forums.gentoo.org/viewtopic-t-709953.html and here http://forums.gentoo.org/viewtopic-t-712723.html
I don't want to type it again because it is long and painfull. Please open the above URLs.

Reproducible: Always

Steps to Reproduce:
1. install syslog-ng, logwatch and logrotate
2. start syslog-ng 
3. set rootlogin=no, and use a local user to su- to root via ssh
4. wait one day or force logwatch to submit a report mail
5. you will see the output of the mail similar to my problem.

Actual Results:  
I've got fustrated :)

Expected Results:  
it should have told me the actual user who sued

I'm using syslog-ng, logrotate and logwatch, the latest versions.

Comment 1 Christian Hoffmann (RETIRED) gentoo-dev

2008-10-27 14:05:33 UTC

If I got it correctly, this is just wrong behaviour and not a security bug. Assigning as maintainers as such.

Comment 2 Benedikt Böhm (RETIRED) gentoo-dev

2009-12-03 17:54:01 UTC

if this is still an issue please attach a logfile excerpt from su/sudo

Comment 3 Benedikt Böhm (RETIRED) gentoo-dev

2009-12-04 11:15:36 UTC

*** Bug 269384 has been marked as a duplicate of this bug. ***

Comment 4 Benedikt Böhm (RETIRED) gentoo-dev

2009-12-04 11:24:45 UTC

fixed in sys-apps/logwatch-7.3.7_pre20091204