Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm new about configure audit system. And I have some tasks such as

configure audit system to audit failed attempts to access files and programs.
configure audit system to audit files and programs deleted by user...
...

I am very confused about the tasks. Could anyone provided some tutorial or reference links? So that I can get clear about what is audit?
How to configure audit system?

Thanks a lot!

share|improve this question

migrated from stackoverflow.com Sep 2 '10 at 17:48

This question came from our site for professional and enthusiast programmers.

    
How to configure the audit system depends greatly on the software whose audit system you are trying to configure - different software packages have different audit systems, and unless you're writing your own, this seems more like a serverfault.com question than stackoverflow. In any case, you'll need to give more details to get useful answers. –  alanc Sep 2 '10 at 17:33

2 Answers 2

up vote 1 down vote accepted

Note that this is written from the point of view of Solaris, but it still applies to Linux, but some commands and configurations will differ - the general principle is the same though.

The first step is to enable auditing, which is done by running /etc/security/bsmconv and answering y to the question, and then reboot to load the kernel module which is required for auditing to occur.

Next step is to configure what you should audit, which is done in /etc/security/audit_control. There you list what the classes of events which should be audited, and since you haven't provided a complete list, I'll give you a rough estimate of what you might need:

flags:lo,ex,fm,fd,ad
naflags:na,lo,ad

This will audit login and logout events, executions, file modifications and deletions, and administrative events. The complete list of audit classes can be found in /etc/security/audit_class. Which classes should be configured is determined by your company's security policy, so be sure to review it.

Finally tell the audit daemon to load the changes you just made using audit -s. This will generate an audit trail in /var/audit which can searched sorted using the auditreduce command and then be translated into human readable format by the praudit command.

You should also configure log rotation (in cron) using audit -n to prevent the audit file from becoming too large.

share|improve this answer
    
Martin, thanks a lot for your detailed information. –  zhaojing Sep 6 '10 at 15:19

In this case they are using the word "audit" as the ability to detect this behavior. I am pretty sure that the only way to detect this behavior is with a kernel module. There maybe one already written, but I do not know of one.

share|improve this answer
    
Rook, thanks for your suggestions! I will have a investigation of this. –  zhaojing Sep 6 '10 at 15:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.