/dev/pts/0 vs /pts/0

Latest response

I just noticed that when I see sudo in /var/log/secure, the associated terminal is always "/dev/pts/0" but when it's su it is just "pts/0". Here are 2 examples:

 

Time: UTC

Server:

Message: >> <14>Apr 15 09:17:59 audispd: node=server1 type=CRED_ACQ msg=audit(1366010279.044:1584474): user pid=15118 uid=0 auid=15357 msg='PAM: setcred acct="oracle" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'

 

Time:

Server:

Message: >> <14>Apr 15 09:17:59 audispd: node=server1 type=CRED_ACQ msg=audit(1366010279.028:1584467): user pid=15118 uid=0 auid=15357 msg='PAM: setcred acct="root" : exe="/usr/bin/sudo" (hostname=server1, addr=, terminal=/dev/pts/0

Our Security team is very much concerned about this. Is it going to be security flaw? Please help me.

DM

Responses