I want to track whether a normal user attempted to run a service. The command for starting/stopping service is given as below:

service filebeat start

I wrote an auditd rule like below:

-w /usr/sbin/service -p warx -k service_attempt

For each time I start/stop the service, it is logging the tag (service_attempt), but the audit is not failing. Because of this I am not able to differentiate between a successfull attempt and an unsuccessful attempt to start/stop a service.

migrated from security.stackexchange.com Mar 1 at 13:13

This question came from our site for information security professionals.

  • It seems like this isn't a Security Question and belongs more to a StackExchange that covers the administration of Linux Servern. – Serverfrog Mar 1 at 13:04

I am a little confused by your question as /var/log/auth.log already logs denied service stop/start by users without permission.

If you want to only see the service related events and only FAILED attempts, you can run as

$sudo cat /var/log/auth.log | grep service | grep FAILED

Here is a sample output of a basicuser I just created without sudo, that then tried to run service alsa-state restart . The output tells you all that you may need to know, and I put the important parts (date, session, FAILED, service name, username) in bold

foot@BOOT:~# cat /var/log/auth.log | grep service | grep FAILED 

Mar 1 21:13:24 BOOT polkitd(authority=local): Operator of unix-session:6 FAILED to authenticate to gain authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.255 [systemctl start alsa-state.service] (owned by unix-user:basicuser)

The auth.log file will tell you all that you need to know regarding authorization failures including services and login attempts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.