7

I am trying to configure a CentOS 7 running in VirtualBox to send its audit logs to the host which is FreeBSD 10.3. Ideally, I'd like to receive the logs with FreeBSD's auditdistd(8) but for now I'd just like to be able to use netcat for that.

My problem is that netcat doesn't get any data.

Details

  1. When I run service auditd status I get the following results:
Redirecting to /bin/systemctl status  auditd.service
auditd.service - Security Auditing Service
   Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2016-08-19 11:35:42 CEST; 3s ago
  Process: 2216 ExecStartPost=/sbin/augenrules --load (code=exited, status=1/FAILURE)
 Main PID: 2215 (auditd)
   CGroup: /system.slice/auditd.service
           ├─2215 /sbin/auditd -n
           └─2218 /sbin/audispd

Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote has exceeded max_restarts
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted

Setup

Network Setup

  1. CentOS and FreeBSD are connected on a host-only network. I've assigned them the following IP's:
  • CentOS: 192.168.56.101
  • FreeBSD: 192.168.56.1

FreeBSD Setup

  1. I've got netcat listening on port 60:

     nc -lk 60
    

The connection works. I can use nc 192.168.56.1 60 on CentOS to send data to FreeBSD.

CentOS Setup

  1. The kernel version is: 4.7.0-1.el7.elrepo.x86_64 #1 SMP Sun Jul 24 18:15:29 EDT 2016 x86_64 x86_64 x86_64 GNU/Linux.

  2. The version of Linux Audit userspace is 2.6.6.

  3. auditd is running and actively logging to /var/log/audit.log.

  4. The auditing rules in /etc/audit/rules.d/ are well configured.

  5. The configuration of /etc/audisp/audisp-remote.conf looks like this:

     remote-server = 192.168.56.1
     port = 60
     local_port = any
     transport = tcp
     mode = immediate
    
  6. I've got two default files in /etc/audisp/plugins.d/: syslog.conf and af_unix.conf and both of them are not active. I've added af-remote.conf and it looks like this:

     # This file controls the audispd data path to the
     # remote event logger. This plugin will send events to
     # a remote machine (Central Logger).
    
     active = yes
     direction = out
     path = /sbin/audisp-remote
     type = always
     #args =
     format = string
    

It is a modified example from the official repository (link).

  1. Here's the content of /etc/audisp/audispd.conf:

     q_depth = 150
     overflow_action = SYSLOG
     priority_boost = 4
     max_restarts = 10
     name_format = HOSTNAME
    

I'll be happy to provide more details if needed.

1 Answer 1

6

I am not sure if everything here is needed to succeed. Nevertheless, this is a configuration which works so that I am able to receive Linux Audit logs with a netcat on FreeBSD.

  1. CentOS:/etc/audisp/audisp-remote.conf:

    remote_server = 192.168.56.1
    port = 60
    local_port = 60
    transport = tcp
    mode = immediate
    queue_depth = 200
    format = managed
    
  2. CentOS:/etc/audisp/plugins.d/au-remote.conf:

    active = yes
    direction = out
    path = /sbin/audisp-remote
    type = always
    args = /etc/audisp/audisp-remote.conf
    format = string
    
  3. CentOS:/etc/audit/auditd.conf:

    local_events = yes
    log_file = /var/log/audit/audit.log
    # Send logs to the server.  Don't save them.
    write_logs = no
    log_format = RAW
    log_group = root
    priority_boost = 8
    num_logs = 5
    disp_qos = lossy
    dispatcher = /sbin/audispd
    name_format = hostname
    max_log_file = 6
    max_log_file_action = ROTATE
    action_mail_acct = root
    space_left = 75
    space_left_action = SYSLOG
    admin_space_left = 50
    admin_space_left_action = SUSPEND
    disk_full_action = SUSPEND
    disk_error_action = SUSPEND
    
    ##tcp_listen_port =
    tcp_listen_queue = 5
    tcp_max_per_addr = 1
    use_libwrap = yes
    ##tcp_client_ports = 1024-65535
    tcp_client_max_idle = 0
    
    enable_krb5 = no
    krb5_principal = auditd
    ##krb5_key_file = /etc/audit/audit.key
    distribute_network = no
    
  4. FreeBSD:/etc/hosts.allow:

     ALL : ALL : allow
    

    I don't know if this one is needed though + it might be a bad idea.


That's it. Now you just have to run nc -lk 60 on FreeBSD and service auditd restart on CentOS. In my case however netcat seems to be receiving/printing every record at least two times which seems rather unusual.

1
  • One note i wanted to share is that /sbin/audisp-remote isn't in the audit rpm (e.g. audit-2.8.5-4.el7.x86_64); it's in audispd-plugins (e.g. audispd-plugins-2.8.5-4.el7.x86_64). I had to go find that and install it as it wasn't already installed on my RHEL 7 (or CENTOS7) systems. Commented Apr 27, 2021 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .