pam_tty_audit.so  [
	disable=patterns
      ] [
	enable=patterns
      ]
The pam_tty_audit PAM module is used to enable or disable TTY auditing. By default, the kernel does not audit input on any TTY.
	    For each user matching patternsenable
	    option matching the same user name on the command line. See NOTES
	    for further description of patterns
	    For each user matching patternsdisable
	    option matching the same user name on the command line. See NOTES
	    for further description of patterns
           Set the TTY audit flag when opening the session, but do not restore
           it when closing the session.  Using this option is necessary for
           some services that don't fork() to run the
           authenticated session, such as sudo.
          
Log keystrokes when ECHO mode is off but ICANON mode is active. This is the mode in which the tty is placed during password entry. By default, passwords are not logged. This option may not be available on older kernels (3.9?).
Error reading or modifying the TTY audit flag. See the system log for more details.
Success.
      When TTY auditing is enabled, it is inherited by all processes started by
      that user.  In particular, daemons restarted by a user will still have
      TTY auditing enabled, and audit TTY input even by other users unless
      auditing for these users is explicitly disabled.  Therefore, it is
      recommended to use disable=* as the first option for
      most daemons using PAM.
    
To view the data that was logged by the kernel to audit use the command aureport --tty.
      The patternsmin_uid:max_uid where
      one of these values can be empty. If min_uid is
      empty only user with the uid max_uid will be
      matched. If max_uid is empty users with the uid
      greater than or equal to min_uid will be
      matched.
    
      Please note that passwords in some circumstances may be logged by TTY auditing
      even if the log_passwd is not used. For example, all input to
      an ssh session will be logged - even if there is a password being typed into
      some software running at the remote host because only the local TTY state
      affects the local TTY auditing.
    
Audit all administrative actions.
session	required pam_tty_audit.so disable=* enable=root