Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have configured auditd for PCI compliance reasons

PCI states that existing logs cannot be changed without generating an alert

This article http://ptresearch.blogspot.com/2010/11/requirement-10-track-and-monitor-all.html recommends doing this:

-w /var/log/ -k Logs_Accessed -p rwxa

Will this auditctl command work? Surely you will end up in a circle with an audit event writing to the log provoking another audit event etc?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Your audit command line will work perfectly. However, if you want some extra protection layers:

  • use chattr to change your logs to be append only
  • have a centralized logging server
  • use SElinux rules to set up a rule enforcing only syslog and daemons themselves can write to /var/log
  • use Unix permissions to make sure /var/log is accessible to only couple of people.
share|improve this answer
    
But if I audit write access to the audit.log file will this cause a loop? –  user185704 Jan 20 '12 at 14:54
    
It should be sensible enough not to chase its tail. Try it, see what happens. –  Janne Pikkarainen Jan 20 '12 at 15:36
    
Yes you are right it works. I was too timid to try it :( –  user185704 Jan 20 '12 at 16:53

The section following that one in that article states that "These messages are processed by daemon syslog, not auditd."

Presumably, that means that the syslog daemon is configured to log those particular messages remotely rather than locally.

This is smart from a security perspective because if you log the fact that someone is altering a file in the same file that they are altering, they can simple remove that entry as well. If you log them remotely, the attacker will have a harder time modifying them. Remote logging of these messages also solves your edit-loop problem.

auditd may have an exception for itself that solves this loop problem but the authors may have just expected you not to create the loop in the first place.

share|improve this answer
    
I have a central syslog server where I send a copy of the audit.log entries. So perhaps I should just stick with that and not audit the audit.log? –  user185704 Jan 20 '12 at 14:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.