Index: monitor.c
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/monitor.c,v
retrieving revision 1.81
diff -u -p -r1.81 monitor.c
--- monitor.c	8 Feb 2005 22:52:17 -0000	1.81
+++ monitor.c	1 Mar 2005 04:57:33 -0000
@@ -192,7 +192,7 @@ struct mon_table mon_dispatch_proto20[] 
     {MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
 #endif
 #ifdef SSH_AUDIT_EVENTS
-    {MONITOR_REQ_AUDIT_EVENT, 0, mm_answer_audit_event},
+    {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
 #endif
 #ifdef BSD_AUTH
     {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
@@ -221,7 +221,7 @@ struct mon_table mon_dispatch_postauth20
     {MONITOR_REQ_TERM, 0, mm_answer_term},
 #ifdef SSH_AUDIT_EVENTS
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
-    {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
+    {MONITOR_REQ_AUDIT_COMMAND, 0, mm_answer_audit_command},
 #endif
     {0, 0, NULL}
 };
@@ -252,7 +252,7 @@ struct mon_table mon_dispatch_proto15[] 
     {MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
 #endif
 #ifdef SSH_AUDIT_EVENTS
-    {MONITOR_REQ_AUDIT_EVENT, 0, mm_answer_audit_event},
+    {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
 #endif
     {0, 0, NULL}
 };
@@ -263,7 +263,7 @@ struct mon_table mon_dispatch_postauth15
     {MONITOR_REQ_TERM, 0, mm_answer_term},
 #ifdef SSH_AUDIT_EVENTS
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
-    {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
+    {MONITOR_REQ_AUDIT_COMMAND, MON_ONCE, mm_answer_audit_command},
 #endif
     {0, 0, NULL}
 };
@@ -344,6 +344,11 @@ monitor_child_preauth(Authctxt *_authctx
 				buffer_free(&m);
 			}
 #endif
+#ifdef SSH_AUDIT_EVENTS
+			/* permit auditting of commands only if authenticated */
+			monitor_permit(mon_dispatch, MONITOR_REQ_AUDIT_COMMAND,
+			    1);
+#endif
 		}
 
 		if (ent->flags & MON_AUTHDECIDE) {
@@ -628,10 +633,6 @@ mm_answer_pwnamallow(int sock, Buffer *m
 	if (options.use_pam)
 		monitor_permit(mon_dispatch, MONITOR_REQ_PAM_START, 1);
 #endif
-#ifdef SSH_AUDIT_EVENTS
-	monitor_permit(mon_dispatch, MONITOR_REQ_AUDIT_EVENT, 1);
-#endif
-
 	return (0);
 }
 
