0

I'm struggling with the following task for AuditD

/etc/passwd should be monitored for any access doesn't matter if a cat or sudo cat is used...ok, easy. BUT I should also prevent auditd to log any other sudo commands that are not used to access /etc/passwd

I'm totally lost at this point. Logging each sudo command by -S execve is easy but only for sudo /etc/passwd gives me headaches.

Improve this question
4
  • I don't understand that problem. It would be easier if you added to the question what you've already tried doing, which command you're using. For instance, to monitor any processes that accesses a file you can run auditctl -w /etc/passwd -p rwa, but I don't know if you've already tried that and what's missing. This command also shows the pid and process name that accessed the file. Also, I don't understand how sudo is related, since you say "doesn't matter if a cat or sudo cat".
    – aviro
    Commented Oct 25, 2022 at 9:55
  • Thanks for your response. The filewatch you mentioned was the easy part. What I need now is this: A user who issues this "sudo vim /etc/passwd" or "cat /etc/passwd" etc. shoud be logged...if a user issues a sudo command like this "sudo vim somefile" ...nothing should be logged.
    – SirStephanikus
    Commented Oct 25, 2022 at 10:05
  • You can see in the audit log this information in the auid field. See here: Records the Audit user ID. This ID is assigned to a user upon login and is inherited by every process even when the user's identity changes (for example, by switching user accounts with su -john).
    – aviro
    Commented Oct 25, 2022 at 11:35
  • Given that /etc/passwd will be accessed every time a user runs ps -fe, ls -l, top, etc, do you really want to scan through all of those logs?
    – doneal24
    Commented Oct 25, 2022 at 12:27

1 Answer 1

Reset to default
0

The auid field in auditlog shows you exactly that. You don't need to audit execve calls for that.

From RHEL Audit System Reference:

auid - Records the Audit user ID. This ID is assigned to a user upon login and is inherited by every process even when the user's identity changes (for example, by switching user accounts with su -john).

For instance, in the following line you could see that the uid was root, but the auid (the original user that ran sudo) was john.

$ ausearch -i -k passwd |grep cat
type=SYSCALL msg=audit(10/25/22 14:49:05.149:376) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x7fffffffe268 a2=O_RDONLY a3=0x0 items=1 ppid=10413 pid=10418 auid=john uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts8 ses=21750 comm=cat exe=/usr/bin/cat subj==unconfined key=passwd

In case you missed, the relevant part is: auid=john uid=root

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .