LIDS FAQ(SSHD)

>Mar 31 18:34:05 petal kernel: LIDS: sshd (dev 3:2 inode 469691)
>pid 19038
>ppid 19034 uid/gid (4008/4000) on (pts) :
>CAP_SYS_TTY_CONFIG violation:
>Attempt to hangup tty
>
>the above happens everytime any user logs into the system using
>ssh.
>
>lids.cap has a + before CAP_SYS_TTY_CONFIG, so ssh and
>any other programs
>given that capability. But where is the violation?


This is merely due to privilege separation function within OpenSSH:
(root) privileged process and user privileged process.
It's a bit annoying, but doesn't cause much trouble, I think.
The user privileged one causes LIDS to print the alert message.