Auditing changes to the audit log

Question

I have configured auditd for PCI compliance reasons

PCI states that existing logs cannot be changed without generating an alert

This article http://ptresearch.blogspot.com/2010/11/requirement-10-track-and-monitor-all.html recommends doing this:

-w /var/log/ -k Logs_Accessed -p rwxa

Will this auditctl command work? Surely you will end up in a circle with an audit event writing to the log provoking another audit event etc?

Answer 1

Your audit command line will work perfectly. However, if you want some extra protection layers:

• use chattr to change your logs to be append only
• have a centralized logging server
• use SElinux rules to set up a rule enforcing only syslog and daemons themselves can write to /var/log
• use Unix permissions to make sure /var/log is accessible to only couple of people.

Answer 2

The section following that one in that article states that "These messages are processed by daemon syslog, not auditd."

Presumably, that means that the syslog daemon is configured to log those particular messages remotely rather than locally.

This is smart from a security perspective because if you log the fact that someone is altering a file in the same file that they are altering, they can simple remove that entry as well. If you log them remotely, the attacker will have a harder time modifying them. Remote logging of these messages also solves your edit-loop problem.

auditd may have an exception for itself that solves this loop problem but the authors may have just expected you not to create the loop in the first place.