Questions tagged [linux-audit]
Content related to the Linux Audit standard which is the most popular auditing tool used in GNU/Linux distributions.
90
questions
0
votes
0answers
33 views
History of commands run by user after logging into root
I have a requirement to audit all the commands run by a user after he logs into root. Can anyone please help me with it. (for Suse-Linux)
To explain even more simpler
user alex logs into the server ...
0
votes
0answers
12 views
internal logrotate mechanism in syslog-ng
Does the syslog-ng has its own rotating mechanism?
I am new to auditing and linux and I though I could use logrotate but I noticed that I need to restart the syslog-ng daemon every time when I use it ...
1
vote
0answers
43 views
Auditd: reboot/login logs are not being added
I've configured auditd to monitor reboots/shutdowns/logins. Tried adding file system rules and syscall rules in a following way:
-w /sbin/shutdown -p x -k power
-w /sbin/poweroff -p x -k power
-w /...
0
votes
0answers
11 views
Linux Audit log rotation name and compression RHEL CentOS 7
Want to set either a weekly or monthly saving of the real-time /var/log/audit/audit.log file to a compressed file having the name such as audit_2020-05-05.log.gz
In RHEL/CentOS 7.x is there an ...
0
votes
1answer
44 views
auditd / auditctl: Are chown and chmod “write” -w type of an operation?
Are chown and chmod “write” -w type of an operation?
I'm using auditd to watch folder permissions. There are different options read, write, execute, attributes.
I just want to watch chmod or chown ...
1
vote
0answers
14 views
Auditctl custom rules for groups
I'm running CentOS8 and I have 4 main groups in my system, I'm trying to create a rule that filters file modification by group. Like for example if the group operators changed my php configuration, I ...
0
votes
0answers
7 views
How to add new rules to dontaudit
How to add new rules to dontaudit.
How do I check on the Internet to show that I have not joined?
0
votes
0answers
47 views
Increasing the level of user_cmd logs to audit.log
I'm working on a RHEL test box which I'm trying to set to mimic audit logging on a production box, which I do not have direct access to.
I do have access to the production boxes logs and I noticed ...
0
votes
1answer
117 views
Questions about audit
After executing the following instruction
auditctl -a always, exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change
it returned the following error
-F ...
1
vote
1answer
126 views
Sniff password entered with read and passed as a command line argument
I'd like to show that entering passwords via read is insecure.
To embed this into a half-way realistic scenario, let's say I use the following command to prompt the user for a password and have 7z¹ ...
1
vote
1answer
24 views
auditd exchange protocol
I'm currently working with auditd. It can be configured to send logs to a remote server using audispd.
But instead of running another auditd instance on a target machine I just want to write my own ...
0
votes
1answer
193 views
rsyslog omprog when an audit logfile is rotated
We have an use case that we need to compress a logfile when it is rotated.
More specifically we have the auditd audit trail that is rotated based on size...
So when the size of the logfile reaches ...
1
vote
1answer
148 views
CIS benchmark does not pass host configuration test
After adding below audit rules for docker artifacts:
$ sudo auditctl -l
-w /usr/bin/dockerd -p rwxa -k docker
-w /var/lib/docker -p rwxa -k docker
-w /etc/docker -p rwxa -k docker
-w /lib/systemd/...
1
vote
0answers
50 views
ausearch not returning matches for AVC and sudo
I'm running auditd with a bunch of rules for PCI-DSS, but i have some anomalies.
cat audit.log | grep type | grep AVC
returns a bunch of entries like
type=AVC msg=audit(1567154215.586:353): ...
0
votes
0answers
20 views
Log connections of any process to a specific host:port
I would like to know which process connects from the local machine to remote host 1.2.3.4 in HTTP.
To get this information about actual processes, the command is
lsof -i@1.2.3.4:80
However, I ...
2
votes
1answer
175 views
How to configure auditd to collect logs from /proc
I've been looking for this for about 2 days and have come up empty-handed.
I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk.
To do this, I need to be able ...
2
votes
2answers
120 views
SELinux security context of parent directories
I'm using a RHEL machine with SELinux enabled.
I'd like to change the logfile position of auditd to /mydir/log/audit.log. I can apply the security context system_u:object_r:auditd_log_t:s0 to this ...
2
votes
0answers
371 views
Auditd, Syslog and Journald
I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me.
According to the things I read, auditd audits events in the ...
2
votes
1answer
69 views
auditctl - logging the CPU or identifier of pthread that invoked the system call
auditctl is a great utility for monitoring many things, such as executed system calls.
I would ideally like to know either the CPU or the POSIX thread that instantiated each recorded system call. In ...
0
votes
1answer
761 views
FreeBSD: How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified?
How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified? Looking at the information here, i don't see how to accomplish the task.
I'm trying to get a ...
1
vote
1answer
2k views
ausearch how to specify both time and date
I can run ausearch based on time:
sudo ausearch --start '16:48:07'
or date:
sudo ausearch --start '05/07/2019'
but not both:
> sudo ausearch --start '05/07/2019 16:48:07'
Invalid start time (...
0
votes
1answer
96 views
How to get type=USER_TTY record in audit.log?
What audit rule needs to be added to get USER_TTY record logged?
Whether it will record all the executed commands under msg field?
0
votes
1answer
341 views
How can we exclude results from users with tty=(none) in auditd?
Is there any way to exclude the event records having tty=(none)
I have tried many ways of adding rule but nothing worked out.
This is my current log file:
> > type=SYSCALL msg=audit(...
0
votes
1answer
126 views
how to extracting only few records from audit.log
How to Extract audit.log
While starting auditd service in linux it records all executed commands as exepected but in addition it records the background process too (the commands which is not executed ...
-2
votes
1answer
954 views
Auditing tool is not working in Kernel version 3.12.14
I am getting the following error while trying to start auditd sevice:
auditctl[2144]:Error - audit support not in kernel
auditctl[2144]:Cannot open netlink audit socket
auditctl[2144]:Started ...
1
vote
1answer
275 views
No system call when malloc after free
While I was playing a little with kernel audit system, I made a small C program:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv){
void *t;
while(1){...
3
votes
1answer
761 views
how to find ssh key in audit log file?
i've created ssh key for connecting two host (client 192.168.4.107 and server 192.168.4.106). on client-machine i've run this command and ssh connection works:
ssh-keygen
ssh-copy-id -i /root/.ssh/...
1
vote
0answers
558 views
How to capture ssh commands on the fly with auditd
There is any way to capture ssh commands executed by an user, on the fly with auditd?
The image exemplifies a case where a user send a command and auditd capture the command in execution time. At ...
0
votes
1answer
511 views
check auditd version
Is there a better/more proper way to check auditd's version on Linux machine than to check it as part of the installed program name?
For instance on Ubuntu in run /usr/bin/dpkg-query -W --showformat '...
0
votes
2answers
1k views
Getting error when stopping auditd
I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to ...
1
vote
0answers
272 views
Why ausearch does not find matches for SYSTEM_BOOT and SYSTEM_SHUTDOWN?
I ask myself why I get no matches when I search for SYSTEM_BOOT or SYSTEM_SHUTDOWN.
ausearch -m SYSTEM_BOOT
ausearch -m SYSTEM_SHUTDOWN
To be sure that events are not getting lost during booting I ...
0
votes
1answer
382 views
Is there an alternative to auditd enabling different log files per filters?
Auditd do not enable to log different filters in different files (cf man pages). Is there an alternative to it which makes it possible, in particular to separate accounts activities?
0
votes
1answer
114 views
aureport -l doesnt show the sucessful count of the user who used “su” command
why the command aureport -l --success --summary -i does show the successful login count of the user who used su command.
The output the above said command only calculates sshd, gdm sessions but not ...
2
votes
1answer
1k views
Kernel / Boot auditing in RHEL 7?
In RHEL5 and RHEL6, I could add audit=1 to start kernel-level auditing during boot before the boot process got as far as starting auditd. Now, in RHEL7, I can't find any mention of audit=1 as a kernel ...
3
votes
0answers
334 views
Can aureport show the full path to files?
I'm tailing auditd.log and piping it into ausearch and then aureport, with the aim of getting a simple stream of modified files:
tail -f /var/log/audit/audit.log | ausearch -k my_key | aureport -f --...
3
votes
1answer
180 views
Changes made with chattr are not detected by auditd
I want to monitor a particular directory using auditd, so that any changes are logged. I've created a rule using:
auditctl -w /etc/my_path_to_monitor -p wa -k my_rule
This works great for everything ...
4
votes
0answers
129 views
What is the modern way to develop a Linux auditing kernel module?
I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports.
I am aware of the things like ...
1
vote
0answers
209 views
auditd misses execution on some commands
I've placed an auditd rule on the jcmd command as follows:
auditctl -w /usr/bin/jcmd -p x -k jvm_debug
However, when I execute it, it writes nothing to log.
Looking at guides and previous questions ...
0
votes
1answer
2k views
auditctl -l shows only few rules
i am using
/etc/audit/rules.d/*.rules
files to generate the
/etc/audit/audit.rules
which has 120 lines.
But if i run
auditctl -l
i get only 14 lines as a result though.
Why is this ...
1
vote
1answer
758 views
How to parse audit_cmd in auditd logs?
I have some lines of auditd.log that contains the key audit_cmd followed by a long string of HEX.
type=USER_CMD msg=audit(<TIMESTAMP>): pid=<PID> uid=<UID> auid=<AUID> ses=...
0
votes
1answer
74 views
How do I differentiate between, xterm and firefox, if both call syscall=socketcall(recvmsg)
---- type=PROCTITLE msg=audit(Sunday 03
September 2017 ^E.370:2020074) : proctitle=/usr/bin/xterm -fg white -bg
black type=SOCKETCALL msg=audit(Sunday 03 September 2017 ^E.370:2020074)
: nargs=3 a0=...
2
votes
0answers
314 views
Is it possible to have auditd log different rules in different log files?
I would like to have some rules logged in a file that is not the default log file defined in /etc/audit/auditd.conf. Is there a way to have auditd log some rules in a separate file?
Something like -w ...
3
votes
0answers
108 views
Why does linux audit daemon restart periodically with the following log?
Sample Log :
type=SERVICE_START msg=audit(1497515461.023:2020433): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="systemd-tmpfiles-clean" exe="/lib/systemd/systemd" ...
0
votes
1answer
628 views
cronjob not redirecting output of command when used with option
I'm not able to redirect output of command into a file when ran with cronjob
[root@mail /]# crontab -l
*/1 * * * * /sbin/ausearch -i > /rummy
[root@mail /]# cat /rummy
It's ...
2
votes
1answer
854 views
RHEL auditd rules -D
I've a confusion over RedHat entriprise linux audit rules.
The audit.rules contains the following
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via ...
1
vote
0answers
313 views
Enabling custom auditd logging in RedHat
I enabled the auditd service using the following configuration to trace all user activities (belonging to group ID 555) on RedHat OS:
vim /etc/audit/audit.rules
-a always,exit -F gid=555 -F arch=b64 -...
1
vote
0answers
98 views
Why does this `aureport` show a question mark in the 'exe' field?
I'm trying to debug why my docker socket changes ownership on a weekly basis.
I created an audit log rule on /var/run/docker.sock.
The audit report shows me many events happening to that socket, but ...
1
vote
0answers
445 views
Interpreting auditd logs part1
Recently, we've enabled auditd on one of our CentOS 7.3 servers and while reviewing some basic reports, I've noticed there's a ton of failed events, say around ~10K a day:
# aureport -x --failed | ...
2
votes
1answer
1k views
how to run a script on auditd events?
I have configured auditd to track some sensitive files on my system. Now I would to have a script that will be called each time auditd writes a line, with the $1 argument of that script being the line ...
1
vote
0answers
387 views
How can I get auditd to report on ONLY the rules I specify with auditctl? (Linux)
Re-started system, cleared rule list with auditctl, but auditd still reports on stuff. Why? How do I add rules to report only on what I want? When I add a rule, other stuff is reported too. Note: I ...
