How to send audit logs with audisp-remote and receive them with netcat

Question

I am trying to configure a CentOS 7 running in VirtualBox to send its audit logs to the host which is FreeBSD 10.3. Ideally, I'd like to receive the logs with FreeBSD's auditdistd(8) but for now I'd just like to be able to use netcat for that.

My problem is that netcat doesn't get any data.

Details

1. When I run service auditd status I get the following results:

Redirecting to /bin/systemctl status  auditd.service
auditd.service - Security Auditing Service
   Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2016-08-19 11:35:42 CEST; 3s ago
  Process: 2216 ExecStartPost=/sbin/augenrules --load (code=exited, status=1/FAILURE)
 Main PID: 2215 (auditd)
   CGroup: /system.slice/auditd.service
           ├─2215 /sbin/auditd -n
           └─2218 /sbin/audispd

Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote has exceeded max_restarts
Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted

Setup

Network Setup

1. CentOS and FreeBSD are connected on a host-only network. I've assigned them the following IP's:

• CentOS: 192.168.56.101
• FreeBSD: 192.168.56.1

FreeBSD Setup

1. I've got netcat listening on port 60:

    nc -lk 60
   

The connection works. I can use nc 192.168.56.1 60 on CentOS to send data to FreeBSD.

CentOS Setup

0. The kernel version is: 4.7.0-1.el7.elrepo.x86_64 #1 SMP Sun Jul 24 18:15:29 EDT 2016 x86_64 x86_64 x86_64 GNU/Linux.

1. The version of Linux Audit userspace is 2.6.6.

2. auditd is running and actively logging to /var/log/audit.log.

3. The auditing rules in /etc/audit/rules.d/ are well configured.

4. The configuration of /etc/audisp/audisp-remote.conf looks like this:

    remote-server = 192.168.56.1
    port = 60
    local_port = any
    transport = tcp
    mode = immediate
   

5. I've got two default files in /etc/audisp/plugins.d/: syslog.conf and af_unix.conf and both of them are not active. I've added af-remote.conf and it looks like this:

    # This file controls the audispd data path to the
    # remote event logger. This plugin will send events to
    # a remote machine (Central Logger).
   
    active = yes
    direction = out
    path = /sbin/audisp-remote
    type = always
    #args =
    format = string
   

It is a modified example from the official repository (link).

5. Here's the content of /etc/audisp/audispd.conf:

    q_depth = 150
    overflow_action = SYSLOG
    priority_boost = 4
    max_restarts = 10
    name_format = HOSTNAME
   

---

^{I'll be happy to provide more details if needed.}

Answer 1

I am not sure if everything here is needed to succeed. Nevertheless, this is a configuration which works so that I am able to receive Linux Audit logs with a netcat on FreeBSD.

1. CentOS:/etc/audisp/audisp-remote.conf:

   remote_server = 192.168.56.1
   port = 60
   local_port = 60
   transport = tcp
   mode = immediate
   queue_depth = 200
   format = managed
   

2. CentOS:/etc/audisp/plugins.d/au-remote.conf:

   active = yes
   direction = out
   path = /sbin/audisp-remote
   type = always
   args = /etc/audisp/audisp-remote.conf
   format = string
   

3. CentOS:/etc/audit/auditd.conf:

   local_events = yes
   log_file = /var/log/audit/audit.log
   # Send logs to the server.  Don't save them.
   write_logs = no
   log_format = RAW
   log_group = root
   priority_boost = 8
   num_logs = 5
   disp_qos = lossy
   dispatcher = /sbin/audispd
   name_format = hostname
   max_log_file = 6
   max_log_file_action = ROTATE
   action_mail_acct = root
   space_left = 75
   space_left_action = SYSLOG
   admin_space_left = 50
   admin_space_left_action = SUSPEND
   disk_full_action = SUSPEND
   disk_error_action = SUSPEND
   
   ##tcp_listen_port =
   tcp_listen_queue = 5
   tcp_max_per_addr = 1
   use_libwrap = yes
   ##tcp_client_ports = 1024-65535
   tcp_client_max_idle = 0
   
   enable_krb5 = no
   krb5_principal = auditd
   ##krb5_key_file = /etc/audit/audit.key
   distribute_network = no
   

4. FreeBSD:/etc/hosts.allow:

    ALL : ALL : allow
   

   I don't know if this one is needed though + it might be a bad idea.

---

That's it. Now you just have to run nc -lk 60 on FreeBSD and service auditd restart on CentOS. In my case however netcat seems to be receiving/printing every record at least two times which seems rather unusual.