Questions tagged [audit]
The audit tag has no usage guidance.
139
questions
0
votes
0answers
34 views
What caused traffic on port 631?
After I turn on my computer, something triggers tcp packets from localhost with source port 631. I replicated the packets using the command ipptools.
Assuming I got it right, is there a way for me to ...
0
votes
1answer
11 views
accessing /var/log/audit/audit.log without root password
under RHEL 7.8
drwxr-xr-x. 20 root root 4096 May 1 11:13 var
drwxr-xr-x. 24 root root 4096 Sep 27 03:22 log
drwx------. 2 root root 4096 Sep 2 03:34 audit
-rw-------...
0
votes
1answer
17 views
SUSE LINUX 11 - Being Able To Collect User Information (Audit)
I added the following lines to the /etc/audit/audit.rules file and restarted the machine:
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/...
-2
votes
1answer
36 views
Logging SSH commands on Linux - is custom kernel the only way?
I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.
Even after making changes to instantly log the command and ...
0
votes
0answers
14 views
Using auditd to monitor execution of scripts
I'm trying to log execution of scripts (bash, python, perl, php) with command line params using auditd. I don't want to add execve to my config as it brings too much noise. In my audit.rules I have ...
0
votes
1answer
24 views
auditd not compressing logs during rotation
Audit is not compressing any logs. Perhaps this is a config issue. Could you perhaps tell me what's causing this in the below config?
local_events = yes
write_logs = yes
log_file = /var/log/audit/...
0
votes
1answer
30 views
Can not log permission denied errors using auditctl [closed]
I try to create an auditctl rule for the following situation:
There is a file created by root, owned by root, and with chmod 700. So no other user except root can read or write to it.
When I then try ...
0
votes
0answers
31 views
By using Audit -S execve I want to log only single parent command in audit.log, not child commands
I'm Vish and I am a newbie to auditd and working on Debian version 10.
My requirement is monitor the shell/bash commands executed by users and due to lack of storage space, to log only the exact ...
2
votes
2answers
54 views
Kill OS if process is killed
I have a bespoke monitoring application I'm deploying on a linux cluster I wish to secure.
I would like the process not to be possible to kill.
That said, senior users need root.
I read that I can ...
1
vote
1answer
333 views
How to log connect/disconnects of outgoing ssh sessions?
I'm looking to log connections/disconnections from outgoing ssh sessions. Is this something auditd can do? I am able to get logs via auditbeat of the connections going outbound but the tricky part is ...
0
votes
2answers
154 views
Questions about audit
After executing the following instruction
auditctl -a always, exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change
it returned the following error
-F ...
6
votes
1answer
109 views
How to detect which process has used a file now or in the past
This is a hypothetical question, not a problem I currently have.
How do you detect which process has used a file now or in the past?
To find out which process is accessing filename right now, lsof ...
4
votes
1answer
849 views
Why do I get a warning for the sudoers.d when doing an audit with Lynis?
I stumbled upon Lynis - a security auditing tool for linux - and ran it on my Raspberry Pi to see if I could harden it a bit more. I got one warning in the Authentication group that confuses me.
- ...
2
votes
1answer
57 views
Can substantial data theft (file access) be detected after the fact?
Suppose an employee came in to the office for a whole day over the weekend and shortly thereafter handed in their notice.
Is there a way on Linux (in our case Centos 7) to eliminate the possibility ...
1
vote
1answer
118 views
ausearch: NOT operator in string match
When examining network activity logs from audit, I want to exclude a few programs I know, e.g. firefox.
ausearch -x firefox -i
brings up all firefox-related connections. But common NOT-operators ...
1
vote
1answer
126 views
Perform special action on bash timeout
This question is related only to bash, no ssh or any other tool.
I would like to detect a bash timeout, and only a timeout: I am NOT interested in any other exit conditions (exit, EOF, ^D, or ...
0
votes
1answer
35 views
How to interpret /var/log output
I have trouble interpreting the following output from /var/log. Both lines show the same result but of different date? What does this mean?
Currently doing an audit to ensure that the directories are ...
1
vote
0answers
91 views
Continuously monitoring network connections
I am looking for a network monitoring tool that can monitor all opened network connections in real-time and its output is easy to parse. What I want to achieve is auditing all in/out network ...
3
votes
0answers
76 views
How to disable sudo in containers from audit logging to host
How do I disable sudo inside of LXC containers from writing to the audit log on the host?
Both the host and containers are Fedora 29. We run many containers running automated tests. Some of those ...
3
votes
0answers
454 views
Auditd, Syslog and Journald
I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me.
According to the things I read, auditd audits events in the ...
0
votes
1answer
48 views
How to inventory apps on Linux Desktop?
[N.B. My first post - guidance welcomed]
We have a small local network of users (5) on deb-based systems and would like to maintain an index of apps installed.
How can we, programmatically, ...
0
votes
1answer
380 views
why would ldconfig create a symlink to libselinux.so.1 from libext2fs.so.2?
using strace I have found a behaviour of ldconfig (glibc), I can make no sense of
lstat("/usr/lib/libext2fs.so.2", {st_mode=S_IFLNK|0777, st_size=16, ...}) = 0
unlink("/usr/lib/libext2fs.so.2") ...
1
vote
0answers
75 views
How do you configure auditd logs to show up in journalctl?
I cannot find the usual auditd logs when doing "journalctl | grep msg=audit". However, I do see the auditd logs in /var/log/audit/audit.log and when doing ausearch. Is there a way to configure it so ...
0
votes
1answer
143 views
how to extracting only few records from audit.log
How to Extract audit.log
While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed ...
1
vote
2answers
817 views
Understanding the audit log - file permissions and file content changed
I need to understand the log below, my index.php got obfuscated code, and file permissions changed from 644 to 755 as well.
I've got something in my audit but can't really tell what and how it ...
1
vote
1answer
462 views
Tracking all file changes in a unix host
I'm evaluating a tool and I need to identify all files (including system config files) added, changed or removed by this application (it is installed using pip).
After installing on a external host, ...
2
votes
1answer
1k views
How to log failure to start/stop a service?
I want to track whether a normal user attempted to run a service.
The command for starting/stopping service is given as below:
service filebeat start
I wrote an auditd rule like below:
-w /usr/sbin/...
1
vote
0answers
32 views
Freeze Linux when log is full
Is it possible to configure a Linux server to stop all operations when it cannot create logs, similar to the security policy in Windows called "Audit: Shut down system immediately if unable to log ...
0
votes
1answer
597 views
check auditd version
Is there a better/more proper way to check auditd's version on Linux machine than to check it as part of the installed program name?
For instance on Ubuntu in run /usr/bin/dpkg-query -W --showformat '...
2
votes
1answer
271 views
What is the purpose of auditctl -a never,task?
I see that whenever I start a new ec2 server the default rule for auditctl
is
auditctl -a never,task
What is the purpose of having this rule?
0
votes
2answers
2k views
Getting error when stopping auditd
I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to ...
2
votes
1answer
192 views
Audit file modifications over ssh in Linux
I wanted to monitor all the modifications made to file in Linux server
On some research I found audit tool which I have installed and configured using following commands
yum install audit # ...
1
vote
1answer
549 views
Encryption of syslog & auditd in local disk? [closed]
We need to use encrypted syslog and auditd in local disk.
Is it possible to save syslog and auditd message encrypted in disk ?
1
vote
2answers
31 views
servresolv.conf become blank when system is running
I use dhcpcd to manage this file.
First, start dhcpcd service, and the file has something with namesever.
All things can be done correctly.
But this file will become blank after a while.
I try ...
0
votes
1answer
47 views
How is source code reviewed/audited, prior to inclusion in linux mainline?
An answer to this question would provide insight and references about how the linux kernel source code is reviewed prior to be released?
Particular interesting aspect of this question to me are:
Who ...
1
vote
0answers
115 views
AIX auditpr timestamp format
Is there a way to customize the timestamp format that the auditpr command on AIX generates?
I am logging to binary, and when I use auditpr to read the binary audit logs, I get something similar to :
...
1
vote
0answers
303 views
Why ausearch does not find matches for SYSTEM_BOOT and SYSTEM_SHUTDOWN?
I ask myself why I get no matches when I search for SYSTEM_BOOT or SYSTEM_SHUTDOWN.
ausearch -m SYSTEM_BOOT
ausearch -m SYSTEM_SHUTDOWN
To be sure that events are not getting lost during booting I ...
1
vote
1answer
577 views
What is the Windows equivalent of 'Audit log cleared' event in Unix/Linux?
Windows has EventID 1102 "The audit log was cleared". What is the equivalent audit event in Unix/Linux?
If someone has a sample event, and know what audit policy needs to be configured to get this ...
3
votes
1answer
690 views
How to decode audit logs
I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this:
time->Tue Jun 12 16:23:34 2018
type=...
1
vote
1answer
822 views
Difference between Failed Authentications and Failed Logins in aureport [closed]
Lately I've been exploring the aureport tool, but I've noticed the following in the outputs and behavior of it.
For example, running the following command:
# aureport --failed
Displays the ...
0
votes
1answer
118 views
aureport -l doesnt show the sucessful count of the user who used “su” command
why the command aureport -l --success --summary -i does show the successful login count of the user who used su command.
The output the above said command only calculates sshd, gdm sessions but not ...
0
votes
1answer
255 views
How to install audit2allow on Alpine Linux 3.5?
I am coming from an apt-get background and am now trying (and failing) to use Alpine Linux's apk utility for package management.
I try running apk install audit2allow and end up with a help message ...
1
vote
1answer
71 views
Fastest way to locate any files/dirs with different ACLs than parent? (FreeBSD)
As the question says.
I have a data pool with ~ 10M files with access controlled by NFSv4 ACLs. It's usable from CLI, Samba, sometimes by daemon processes or rsync, and for some dirs by ftp/sftp, so ...
0
votes
1answer
179 views
Logger -f command killed opening /var/log/messages in tail
I'm trying to run this command on CentOS.
logger -t AUDIT_LOG -f <MY_AUDIT_LOG_FILE> &
It works correctly for 10/20 seconds. Opening /var/log/messages in tail I can correctly see messages ...
1
vote
0answers
97 views
Shell command audit for a single user
What is the easiest way to log all the commands ran in the all different shells (bash, zsh...) by a certain user to a file, syslog or somewhere else?
0
votes
0answers
31 views
Is there a way to log attempts to change a file in RHEL6?
We have a RHEL6 server that was built using an old homegrown build platform. The team that built the platform was disbanded, and all members have moved on. So, we are trying to figure out everything ...
3
votes
0answers
353 views
Can aureport show the full path to files?
I'm tailing auditd.log and piping it into ausearch and then aureport, with the aim of getting a simple stream of modified files:
tail -f /var/log/audit/audit.log | ausearch -k my_key | aureport -f --...
3
votes
1answer
192 views
Changes made with chattr are not detected by auditd
I want to monitor a particular directory using auditd, so that any changes are logged. I've created a rule using:
auditctl -w /etc/my_path_to_monitor -p wa -k my_rule
This works great for everything ...
7
votes
2answers
2k views
List all programs used by a shell script
I'm trying to figure out a method to list all the programs that a script will use when it will be run, without actually running it.
I've written these quick and dirty oneliners:
# fill an array with ...
0
votes
1answer
142 views
How to enable audit on access to files (rwx) in SLES9
How can I enable audit on access to specific files in Suse Linux Enterprise 9?
