Centos 7 --> Logging Failed Permission Changes By Another User?

Question

I've been trying to figure this one out and it seems like a rather easier said than done situation. I am currently setting up a server that sends errors, failed logons, who accessed what and when, etc....

I'm trying to figure out how I can track a user if they try to make a permission change. Say Bob runs 'chmod 777 ' but he does not have the permission to change said file. So instead of the system telling him no he can't do that, it also throws back an error that I can see that an attempt was made. How can I get that error to be logged (if it isn't already) and where would that location be stored? /var/log/messages? OR, would I have to set up an auditctl rule for this to work like I want it too? Thank you all in advance

Answer 1

From man auditctl:

To watch a file for changes (2 ways to express):

auditctl -w /etc/shadow -p wa
auditctl -a always,exit -F path=/etc/shadow -F perm=wa

• -w: Insert a watch for the file system object at path, i.e. /etc/shadow.
• -p: Set permissions filter for a file system watch. w=write, x=execute, a=attribute change.

You can also add -k which will help search audit logs for these events using ausearch.

• -k: Set a filter key on an audit rule. The filter key is an arbitrary string of text that can be up to 31 bytes long. It can uniquely identify the audit records produced by a rule.

The rule will actually need to be put in /etc/audit/audit.rules to be permanent. auditd will need to be enabled and started as well (systemctl enable auditd.service and systemctl start auditd.service).

You can find more information in this Red Hat solution article. You are running CentOS, so the details here will still directly apply to you.