On Mon, Jun 22, 2015 at 02:03:59PM +0200, Michael Ströder wrote:
I'd be glad if this RFE could make it into 1.13.x:
By no means would I like to question the benefit of the RFE. However, in your comment there, you say
To add an important use-case for this: If a machine got hacked and the login logs are manipulated you would still see in the LDAP server's log from IP address a password check was initiated.
That is really an argument for remote logging in general, not for session tracking. If the system is compromised, the attacker can feed whatever information it wants to the LDAP server. Yes, they will also be able to change existing (old) login logs in /var/log on the client but the solution is really not to rely on those but have them transferred to secure location as soon as reasonably possible.