Questions tagged [audit]
The audit tag has no usage guidance.
171
questions
0
votes
0
answers
11
views
How can I get `auditctl` to provide error information?
EDIT
This may be the result of an issue with the Arch package.
I am learning to use the linux audit system. Right now I have several rulesets in the /etc/audit/rules.d directory.
When I run
...
0
votes
0
answers
32
views
AuditD understanding exit,always,exclude,never
I see these 4 exit, always, exclude, and never commonly used in many different combinations like below:
-a exit,always
-a exit,never
-a exclude,always
-a exclude,never
I'm trying to understand what ...
- 1,744
0
votes
0
answers
29
views
Auditd not logging certain user management events
I'm trying to track user management changes such as adding user to groups.
I'm currently testing it on 2 machines and receive different results:
Ubuntu 22.04.3 LTS (Jammy Jellyfish)
Rocky Linux 9.2 (...
0
votes
0
answers
22
views
AuditD - tuning out parent and children
I'm reading over the AuditD readmes and I see how you can use filters but is there a way that you can tune out a parent and any activity they create along with their children processes?
For example, I ...
- 1,744
0
votes
1
answer
142
views
auditd logs- /lib/ld-linux-x86-64.so.2 flooding logs
I am running auditd on a Debian 11 server with a very generic set of audit rules. The audit log is filled with entries like below. I'm not sure what they are - can anyone help identify these? I'm ...
- 15
2
votes
1
answer
318
views
Enabling command hashing in tcsh
It seems command hashing is disabled by default in our tcsh environment, and I'm not permitted to get it enabled across the board. Instead I'm looking to enable command hashing within individual ...
- 165
1
vote
1
answer
81
views
Force tcsh to check whether command exist in the path before attempting to execute it
I've noticed that tcsh, regardless of whether "-f" flag is passed on the shebang line, will iterate through $PATH, and try to execute the command from that path until the command is found. ...
- 165
1
vote
1
answer
276
views
How do I configure auditd to print the ppid name, not just the ppid?
OS is Debian. I have set up auditd to try and determine what is rebooting a system.
I have the following rule:
-a exit,always -F arch=b64 -S execve -F path=/bin/systemctl -k debug_test
Creating a ...
- 195
0
votes
1
answer
1k
views
audit rule doesn't load via systemctl restart auditd
I was trying to see what was enabling ipv4 forwarding in file /proc/sys/net/ipv4/ip_forward (I've discovered that this was docker, but I'd still like to understand my auditd issue)
So I decided to ...
- 91
0
votes
0
answers
83
views
Find most common offender in audit.log
I have a situation where a clean install of RHEL 8.8 and having auditd running with a given /etc/audit/rules.d/audit.rules file produces a /var/log/audit/audit.log that is greater than 4GB. This is ...
- 7,423
0
votes
1
answer
47
views
Users setup with misspelled name - CentOS 8
I have a user with a misspelled username on my CentOS 8 system which I thought I had corrected but I have noticed the username is showing up in the audit log incorrectly.
The correct username is:
...
- 1
-1
votes
1
answer
107
views
I would like to audit an Ubuntu server to get a list of all files executed and all files read by the kernel
I want to be able to instrument and analyze at a prebuilt server and get a list of every file read.
I would also like to determine which of those files were read by the kernel to execute a program, ...
- 109
1
vote
2
answers
741
views
Linux How to find the id of a user who ran some particular command using sudo [duplicate]
In shared environment where multiple users have sudo account, I want to find out underlying user id (not a sudo account) details who has invoked particular script. Thanks.
I tried below but it does ...
- 11
0
votes
3
answers
591
views
In Linux how to find if a file was read and at what time
Is there a tool or command where we can see if a file was read and at what time? I would only find for last modified.
- 211
0
votes
0
answers
427
views
Audit Logging Discrepancy: Journald vs Rsyslog
After installing Debian 12 and rsyslog 8.2302 (for TLS remote syslog), I noticed that apparmor logs (or any audit logs) were not being sent remotely.
After reviewing the local system, journald DOES ...
user432564
1
vote
0
answers
42
views
Linux audit logs coming in with capitalized field names (SYSCALL, AUID) Rhel 7
I've never encountered this before so not even sure where to start. I'm installing a log parser on a system but for some reason all audit logs are coming in with the field names capitalized. So ...
- 11
1
vote
1
answer
391
views
audit does not record file events (but works for network events) in fedora
I want to monitor access to a file using audit, and hence added the following rule
-w /home/test.txt -k monitoring-test
I reloaded the rules (sudo service auditd restart) and modified the file /home/...
- 113
0
votes
1
answer
178
views
Auditd stops monitoring USB mount point when USB is removed then reinserted
I'm working on scripted monitoring of USB activity: file reads, writes, folder creations, etc. Our codebase automatically sets up a mount point in: /media/usb/mounted_usb_name, when a USB device is ...
2
votes
0
answers
29
views
Unixware: how to enable auditing for specific user?
On Unixware I have enable auditing
auditon
create the map
auditmap
The log report is working
auditrpt -b
But only for root!
auditrpt -u root|wc -l
647
I try to set a mask for auditing for another ...
- 13.1k
1
vote
1
answer
1k
views
What is writing to my /dev/dm-2 Volume?
I'm running a STIG version of RHEL, and I’m having trouble figuring out how all of my logical volumes map.
/dev/mapper/vg1_audit seems to point to /dev/dm-2
/dev/vg1/lv_audit also seems to map to /dev/...
- 113
0
votes
1
answer
96
views
Configuring AIX auditing for rmdir and syslog collection
How can the auditing feature in an AIX Unix system be configured to collect information about the removal of a directory (though rmdir) and send it to syslog?
- 1
0
votes
1
answer
2k
views
Arch Linux stuck at boot after a restart
I was just having fun with installing Wayland and customizing it to my liking and when I finally restarted it before I go to bed, it was stuck on the logo. So, I enabled logging for grubs and it's ...
- 1
1
vote
1
answer
284
views
Setting up auditd on FreeBSD 13 to log user commands
I modified /etc/security/audit_control by adding the ex ("exec") and ad ("administrative") audit classes to the flags:
flags:lo,aa,ex,ad
I enabled and started the service
service ...
- 11
0
votes
1
answer
228
views
Is it possible to filter or format the audit dmesg reports?
I like having a terminal open with dmesg so I can see the logs in real-time. However, the audit logs are quite long, and I was wondering if there was a way to filter messages (maybe with sed/awk?) ...
- 23
-1
votes
1
answer
95
views
How to make Linux installation verifiable/auditable?
A major goal of open source is being able to audit/verify the software you run. But the moment we use that software hosted by a third-party we need to trust them..
If I ran an OSS service on a Linux ...
- 1
1
vote
0
answers
250
views
convention of group id for audit
in /etc/audit/auditd.conf there is log_group = root. I have been asks to change that to log_group = audit to facilitate logging.
In RHEL 7.9 there is no audit group defined in /etc/group; someone ...
- 7,423
0
votes
1
answer
53
views
Change audit directory permission to another user beside root
I want to grant permision to another user for audit directory.
[user_audit@crox log]$ cd audit
bash: cd: audit: Permission denied
[user_audit@crox log]$ ls -lrt | grep audit
drwx------. 2 root ...
- 15
0
votes
0
answers
123
views
Linux utility to log user commands and screenshots for auditing
I am looking for a utility that I can implement in linux systems to "audit" user commands in the terminals and take intermittent screenshots for auditing in my systems. Is there a solution ...
- 1
0
votes
0
answers
2k
views
Send audit log to syslog server as independent stream
I have a system which is currently set up via rsyslogd to send /var/log/messages to a syslog server. I also want to send the logs contained in /var/log/audit/audit.log to the same server.
One of the ...
- 683
3
votes
0
answers
2k
views
set sshd SELinux security context
I'm working on my custom board and on my custom UNIX-like O.S. . When I connect using ssh and no root users a receve this SELinux error: A valid context for could not be obtained. where user is not ...
- 31
0
votes
2
answers
414
views
How to log flag changes to files on ext4 and xfs filesystems?
I was wondering how to log flag changes in a file, e.g. chattr +a somefile.
I realized that timestamps shown by stat somefile are not useful to audit flag changes: when the file is appended, it ...
- 3
-3
votes
2
answers
113
views
Is there any way to prevent someone from running a shell as root?
This is a question I've pondered for a long time and thought was impossible.
Is it possible to prevent administrators of a machine from bypassing the audit capabilities of sudo or doas? For instance, ...
- 1
0
votes
1
answer
625
views
Parse audit log commands as a complete command with arguments
I have audit logs that looks as follows:
type=CWD msg=audit(1613110144.560:260397): cwd="/"
type=PATH msg=audit(1613110144.560:260397): item=0 name="/usr/bin/sed" inode=393388 dev=...
0
votes
0
answers
14
views
certificate authority "like" or similar service that provides open source audit and certificate proving project does not contain malicious code
Compliance is not my area, so I apologize for the naive language, as I am having trouble explicitly articulating my want, beyond the following anecdote:
If one were to build a solution for an audience ...
- 428
0
votes
0
answers
629
views
What caused traffic on port 631?
After I turn on my computer, something triggers tcp packets from localhost with source port 631. I replicated the packets using the command ipptools.
Assuming I got it right, is there a way for me to ...
- 33
0
votes
1
answer
1k
views
accessing /var/log/audit/audit.log without root password
under RHEL 7.8
drwxr-xr-x. 20 root root 4096 May 1 11:13 var
drwxr-xr-x. 24 root root 4096 Sep 27 03:22 log
drwx------. 2 root root 4096 Sep 2 03:34 audit
-rw-------...
- 7,423
0
votes
1
answer
55
views
SUSE LINUX 11 - Being Able To Collect User Information (Audit)
I added the following lines to the /etc/audit/audit.rules file and restarted the machine:
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/...
- 97
-2
votes
1
answer
68
views
Logging SSH commands on Linux - is custom kernel the only way?
I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.
Even after making changes to instantly log the command and ...
- 1,744
1
vote
1
answer
2k
views
auditd not compressing logs during rotation
Audit is not compressing any logs. Perhaps this is a config issue. Could you perhaps tell me what's causing this in the below config?
local_events = yes
write_logs = yes
log_file = /var/log/audit/...
- 683
0
votes
1
answer
1k
views
Can not log permission denied errors using auditctl [closed]
I try to create an auditctl rule for the following situation:
There is a file created by root, owned by root, and with chmod 700. So no other user except root can read or write to it.
When I then try ...
- 33
2
votes
2
answers
141
views
Kill OS if process is killed
I have a bespoke monitoring application I'm deploying on a linux cluster I wish to secure.
I would like the process not to be possible to kill.
That said, senior users need root.
I read that I can ...
- 408
3
votes
1
answer
3k
views
How to log connect/disconnects of outgoing ssh sessions?
I'm looking to log connections/disconnections from outgoing ssh sessions. Is this something auditd can do? I am able to get logs via auditbeat of the connections going outbound but the tricky part is ...
- 151
0
votes
2
answers
308
views
Questions about audit
After executing the following instruction
auditctl -a always, exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change
it returned the following error
-F ...
- 1
6
votes
1
answer
542
views
How to detect which process has used a file now or in the past
This is a hypothetical question, not a problem I currently have.
How do you detect which process has used a file now or in the past?
To find out which process is accessing filename right now, lsof ...
- 30.4k
7
votes
1
answer
7k
views
Why do I get a warning for the sudoers.d when doing an audit with Lynis?
I stumbled upon Lynis - a security auditing tool for linux - and ran it on my Raspberry Pi to see if I could harden it a bit more. I got one warning in the Authentication group that confuses me.
- ...
- 157
2
votes
1
answer
77
views
Can substantial data theft (file access) be detected after the fact?
Suppose an employee came in to the office for a whole day over the weekend and shortly thereafter handed in their notice.
Is there a way on Linux (in our case Centos 7) to eliminate the possibility ...
- 155
2
votes
1
answer
889
views
ausearch: NOT operator in string match
When examining network activity logs from audit, I want to exclude a few programs I know, e.g. firefox.
ausearch -x firefox -i
brings up all firefox-related connections. But common NOT-operators ...
- 13.7k
1
vote
1
answer
467
views
Perform special action on bash timeout
This question is related only to bash, no ssh or any other tool.
I would like to detect a bash timeout, and only a timeout: I am NOT interested in any other exit conditions (exit, EOF, ^D, or ...
- 203
0
votes
1
answer
105
views
How to interpret /var/log output
I have trouble interpreting the following output from /var/log. Both lines show the same result but of different date? What does this mean?
Currently doing an audit to ensure that the directories are ...
- 7
1
vote
0
answers
1k
views
Continuously monitoring network connections
I am looking for a network monitoring tool that can monitor all opened network connections in real-time and its output is easy to parse. What I want to achieve is auditing all in/out network ...
- 21