Questions tagged [audit]
The audit tag has no usage guidance.
155
questions
0
votes
1
answer
64
views
What is writing to my /dev/dm-2 Volume?
I'm running a STIG version of RHEL, and I’m having trouble figuring out how all of my logical volumes map.
/dev/mapper/vg1_audit seems to point to /dev/dm-2
/dev/vg1/lv_audit also seems to map to /dev/...
- 103
0
votes
1
answer
41
views
Configuring AIX auditing for rmdir and syslog collection
How can the auditing feature in an AIX Unix system be configured to collect information about the removal of a directory (though rmdir) and send it to syslog?
- 1
0
votes
1
answer
774
views
Arch Linux stuck at boot after a restart
I was just having fun with installing Wayland and customizing it to my liking and when I finally restarted it before I go to bed, it was stuck on the logo. So, I enabled logging for grubs and it's ...
- 1
1
vote
1
answer
81
views
Setting up auditd on FreeBSD 13 to log user commands
I modified /etc/security/audit_control by adding the ex ("exec") and ad ("administrative") audit classes to the flags:
flags:lo,aa,ex,ad
I enabled and started the service
service ...
- 11
0
votes
0
answers
12
views
Logging/recording OS behavioral data and events
I got some CentOS/RHEL servers to manage and monitor, and the OS version varies from 7.5 to 7.9. However, I'm not familiar to the management of linux hosts at all so would like to seek professional ...
- 33
0
votes
1
answer
63
views
Is it possible to filter or format the audit dmesg reports?
I like having a terminal open with dmesg so I can see the logs in real-time. However, the audit logs are quite long, and I was wondering if there was a way to filter messages (maybe with sed/awk?) ...
- 13
-1
votes
1
answer
60
views
How to make Linux installation verifiable/auditable?
A major goal of open source is being able to audit/verify the software you run. But the moment we use that software hosted by a third-party we need to trust them..
If I ran an OSS service on a Linux ...
- 1
0
votes
0
answers
25
views
convention of group id for audit
in /etc/audit/auditd.conf there is log_group = root. I have been asks to change that to log_group = audit to facilitate logging.
In RHEL 7.9 there is no audit group defined in /etc/group; someone ...
- 5,215
0
votes
1
answer
24
views
Change audit directory permission to another user beside root
I want to grant permision to another user for audit directory.
[user_audit@crox log]$ cd audit
bash: cd: audit: Permission denied
[user_audit@crox log]$ ls -lrt | grep audit
drwx------. 2 root ...
0
votes
0
answers
33
views
Linux utility to log user commands and screenshots for auditing
I am looking for a utility that I can implement in linux systems to "audit" user commands in the terminals and take intermittent screenshots for auditing in my systems. Is there a solution ...
- 1
0
votes
0
answers
59
views
auditd not showing certain record events type
I have recently install auditd and play around with it. And i found on ubuntu 18 the auditd log will show record entry like this
audit[23183]: USER_CMD pid=23183 uid=1000 auid=1000 ses=517 msg='cwd=&...
- 39
0
votes
0
answers
249
views
auditd + auditsp doesn't write log to remote server
I set up auditd + audisp on Ubuntu for centralized collection of logs on the server
Config files on the client host:
auditd.conf:
#This file controls the configuration of the audit daemon
#
#...
0
votes
0
answers
795
views
Send audit log to syslog server as independent stream
I have a system which is currently set up via rsyslogd to send /var/log/messages to a syslog server. I also want to send the logs contained in /var/log/audit/audit.log to the same server.
One of the ...
- 643
3
votes
0
answers
782
views
set sshd SELinux security context
I'm working on my custom board and on my custom UNIX-like O.S. . When I connect using ssh and no root users a receve this SELinux error: A valid context for could not be obtained. where user is not ...
- 31
0
votes
2
answers
156
views
How to log flag changes to files on ext4 and xfs filesystems?
I was wondering how to log flag changes in a file, e.g. chattr +a somefile.
I realized that timestamps shown by stat somefile are not useful to audit flag changes: when the file is appended, it ...
- 3
-3
votes
2
answers
89
views
Is there any way to prevent someone from running a shell as root?
This is a question I've pondered for a long time and thought was impossible.
Is it possible to prevent administrators of a machine from bypassing the audit capabilities of sudo or doas? For instance, ...
- 1
0
votes
1
answer
284
views
Parse audit log commands as a complete command with arguments
I have audit logs that looks as follows:
type=CWD msg=audit(1613110144.560:260397): cwd="/"
type=PATH msg=audit(1613110144.560:260397): item=0 name="/usr/bin/sed" inode=393388 dev=...
0
votes
0
answers
13
views
certificate authority "like" or similar service that provides open source audit and certificate proving project does not contain malicious code
Compliance is not my area, so I apologize for the naive language, as I am having trouble explicitly articulating my want, beyond the following anecdote:
If one were to build a solution for an audience ...
- 360
0
votes
0
answers
241
views
What caused traffic on port 631?
After I turn on my computer, something triggers tcp packets from localhost with source port 631. I replicated the packets using the command ipptools.
Assuming I got it right, is there a way for me to ...
- 33
0
votes
1
answer
689
views
accessing /var/log/audit/audit.log without root password
under RHEL 7.8
drwxr-xr-x. 20 root root 4096 May 1 11:13 var
drwxr-xr-x. 24 root root 4096 Sep 27 03:22 log
drwx------. 2 root root 4096 Sep 2 03:34 audit
-rw-------...
- 5,215
0
votes
1
answer
45
views
SUSE LINUX 11 - Being Able To Collect User Information (Audit)
I added the following lines to the /etc/audit/audit.rules file and restarted the machine:
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/...
- 97
-2
votes
1
answer
58
views
Logging SSH commands on Linux - is custom kernel the only way?
I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.
Even after making changes to instantly log the command and ...
- 1,712
1
vote
1
answer
1k
views
auditd not compressing logs during rotation
Audit is not compressing any logs. Perhaps this is a config issue. Could you perhaps tell me what's causing this in the below config?
local_events = yes
write_logs = yes
log_file = /var/log/audit/...
- 613
0
votes
1
answer
744
views
Can not log permission denied errors using auditctl [closed]
I try to create an auditctl rule for the following situation:
There is a file created by root, owned by root, and with chmod 700. So no other user except root can read or write to it.
When I then try ...
- 33
2
votes
2
answers
125
views
Kill OS if process is killed
I have a bespoke monitoring application I'm deploying on a linux cluster I wish to secure.
I would like the process not to be possible to kill.
That said, senior users need root.
I read that I can ...
- 378
3
votes
1
answer
2k
views
How to log connect/disconnects of outgoing ssh sessions?
I'm looking to log connections/disconnections from outgoing ssh sessions. Is this something auditd can do? I am able to get logs via auditbeat of the connections going outbound but the tricky part is ...
- 151
0
votes
2
answers
276
views
Questions about audit
After executing the following instruction
auditctl -a always, exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change
it returned the following error
-F ...
- 1
6
votes
1
answer
244
views
How to detect which process has used a file now or in the past
This is a hypothetical question, not a problem I currently have.
How do you detect which process has used a file now or in the past?
To find out which process is accessing filename right now, lsof ...
- 27.6k
5
votes
1
answer
5k
views
Why do I get a warning for the sudoers.d when doing an audit with Lynis?
I stumbled upon Lynis - a security auditing tool for linux - and ran it on my Raspberry Pi to see if I could harden it a bit more. I got one warning in the Authentication group that confuses me.
- ...
- 127
2
votes
1
answer
70
views
Can substantial data theft (file access) be detected after the fact?
Suppose an employee came in to the office for a whole day over the weekend and shortly thereafter handed in their notice.
Is there a way on Linux (in our case Centos 7) to eliminate the possibility ...
- 155
2
votes
1
answer
534
views
ausearch: NOT operator in string match
When examining network activity logs from audit, I want to exclude a few programs I know, e.g. firefox.
ausearch -x firefox -i
brings up all firefox-related connections. But common NOT-operators ...
- 11.7k
1
vote
1
answer
363
views
Perform special action on bash timeout
This question is related only to bash, no ssh or any other tool.
I would like to detect a bash timeout, and only a timeout: I am NOT interested in any other exit conditions (exit, EOF, ^D, or ...
- 183
0
votes
1
answer
73
views
How to interpret /var/log output
I have trouble interpreting the following output from /var/log. Both lines show the same result but of different date? What does this mean?
Currently doing an audit to ensure that the directories are ...
- 7
1
vote
0
answers
510
views
Continuously monitoring network connections
I am looking for a network monitoring tool that can monitor all opened network connections in real-time and its output is easy to parse. What I want to achieve is auditing all in/out network ...
- 21
3
votes
1
answer
360
views
How to disable sudo in containers from audit logging to host
How do I disable sudo inside of LXC containers from writing to the audit log on the host?
Both the host and containers are Fedora 29. We run many containers running automated tests. Some of those ...
- 11.7k
3
votes
1
answer
3k
views
Auditd, Syslog and Journald
I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me.
According to the things I read, auditd audits events in the ...
- 31
0
votes
1
answer
99
views
How to inventory apps on Linux Desktop?
[N.B. My first post - guidance welcomed]
We have a small local network of users (5) on deb-based systems and would like to maintain an index of apps installed.
How can we, programmatically, ...
- 103
0
votes
1
answer
1k
views
why would ldconfig create a symlink to libselinux.so.1 from libext2fs.so.2?
using strace I have found a behaviour of ldconfig (glibc), I can make no sense of
lstat("/usr/lib/libext2fs.so.2", {st_mode=S_IFLNK|0777, st_size=16, ...}) = 0
unlink("/usr/lib/libext2fs.so.2") ...
- 13.4k
1
vote
0
answers
300
views
How do you configure auditd logs to show up in journalctl?
I cannot find the usual auditd logs when doing "journalctl | grep msg=audit". However, I do see the auditd logs in /var/log/audit/audit.log and when doing ausearch. Is there a way to configure it so ...
- 205
0
votes
1
answer
283
views
how to extracting only few records from audit.log
How to Extract audit.log
While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed ...
- 5
1
vote
2
answers
2k
views
Understanding the audit log - file permissions and file content changed
I need to understand the log below, my index.php got obfuscated code, and file permissions changed from 644 to 755 as well.
I've got something in my audit but can't really tell what and how it ...
- 13
4
votes
1
answer
4k
views
Tracking all file changes in a unix host
I'm evaluating a tool and I need to identify all files (including system config files) added, changed or removed by this application (it is installed using pip).
After installing on a external host, ...
- 209
3
votes
1
answer
4k
views
How to log failure to start/stop a service?
I want to track whether a normal user attempted to run a service.
The command for starting/stopping service is given as below:
service filebeat start
I wrote an auditd rule like below:
-w /usr/sbin/...
- 131
1
vote
0
answers
90
views
Freeze Linux when log is full
Is it possible to configure a Linux server to stop all operations when it cannot create logs, similar to the security policy in Windows called "Audit: Shut down system immediately if unable to log ...
0
votes
1
answer
2k
views
check auditd version
Is there a better/more proper way to check auditd's version on Linux machine than to check it as part of the installed program name?
For instance on Ubuntu in run /usr/bin/dpkg-query -W --showformat '...
2
votes
1
answer
730
views
What is the purpose of auditctl -a never,task?
I see that whenever I start a new ec2 server the default rule for auditctl
is
auditctl -a never,task
What is the purpose of having this rule?
- 21
0
votes
2
answers
4k
views
Getting error when stopping auditd
I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to ...
- 888
2
votes
1
answer
272
views
Audit file modifications over ssh in Linux
I wanted to monitor all the modifications made to file in Linux server
On some research I found audit tool which I have installed and configured using following commands
yum install audit # ...
1
vote
1
answer
1k
views
Encryption of syslog & auditd in local disk? [closed]
We need to use encrypted syslog and auditd in local disk.
Is it possible to save syslog and auditd message encrypted in disk ?
- 1,387
1
vote
2
answers
40
views
servresolv.conf become blank when system is running
I use dhcpcd to manage this file.
First, start dhcpcd service, and the file has something with namesever.
All things can be done correctly.
But this file will become blank after a while.
I try ...
- 248