auditd

Audit subsystem architecture: Kernel audit module | | (netlink socket) | auditd daemon ──writes──→ /var/log/audit/audit.log | └── dispatcher (audispd) ──→ plugins (syslog, remote logging) # Start/stop: systemctl start auditd systemctl enable auditd # Audit log location: cat /var/log/audit/audit.log | head -5 # type=SYSCALL msg=audit(1234567890.123:456): arch=c000003e syscall=2 # success=yes exit=3 a0=7f... a1=0 a2=1b6 a3=0 items=1 ppid=1234 # pid=5678 auid=1000 uid=0 gid=0 euid=0 egid=0 suid=0 sgid=0 # comm="cat" exe="/usr/bin/cat" key="sensitive_files"

# Add rules with auditctl: # Watch a file for reads and writes: auditctl -w /etc/passwd -p rwa -k passwd_access # -w = watch path # -p = permissions to log (r=read, w=write, a=attr, x=execute) # -k = key name (for searching later) # Watch a directory recursively: auditctl -w /etc/sudoers.d/ -p wa -k sudoers_changes # Audit a specific syscall: auditctl -a always,exit -F arch=b64 -S execve -k program_execution # -a always,exit = log every time this syscall exits # -F arch=b64 = 64-bit architecture # -S execve = syscall: execute a program # -k key = tag for searching # Audit failed access attempts: auditctl -a always,exit -F arch=b64 -S open -F exit=-EACCES -k access_denied # Watch for privilege escalation: auditctl -a always,exit -F arch=b64 -S setuid -S setgid -k privilege_change # Make rules permanent (/etc/audit/rules.d/): # /etc/audit/rules.d/99-local.rules: # -w /etc/passwd -p rwa -k passwd_access # -w /etc/ssh/sshd_config -p wa -k sshd_config # Apply persistent rules: augenrules --load

# ausearch — query audit logs ausearch -k passwd_access # by key ausearch -m SYSCALL -ts today # today's syscall events ausearch -ua 1000 # events for UID 1000 ausearch -m LOGIN -ts recent # recent logins # Filter by time: ausearch -ts 08/01/2024 12:00:00 -te 08/01/2024 13:00:00 # Human-readable output: ausearch -k passwd_access -i # time->Mon Jan 15 12:34:56 2024 # type=SYSCALL msg=audit...: arch=x86_64 syscall=openat success=yes # pid=5678 uid=root auid=admin(1000) comm="cat" exe=/usr/bin/cat key=passwd_access # aureport — summary reports aureport --summary # overall summary aureport --failed # failed events aureport --login # login events aureport --auth # authentication events aureport --syscall # syscall summary aureport -x --summary # executable summary (who ran what)

# auditd ships with compliance rule sets: ls /usr/share/audit/sample-rules/ # 10-base-config.rules # 30-pci-dss-v31.rules ← PCI-DSS # 30-nispom.rules ← NSA information system rules # 30-stig.rules ← DISA STIG (government hardening) # 31-privileged.rules ← log all privileged commands # Load STIG rules: cp /usr/share/audit/sample-rules/30-stig.rules /etc/audit/rules.d/ augenrules --load # STIG rules cover: # - All privileged command executions (sudo, su, passwd, etc.) # - User/group modifications # - Network configuration changes # - Kernel module loading # - Failed login attempts