auditd is the userspace component to the Linux Auditing System.

learn more… | top users | synonyms

0
votes
0answers
16 views

SELinux - centos 6.5 run_init asks for password of non privileged user

I log onto my aws centos instance, as user: [user@aws-sonar-01 ~]$ sudo -i [root@aws-sonar-01 ~]# run_init /bin/bash -x -c 'ulimit -S -c 0 ; auditd'; echo $? Authenticating user. Password: + ulimit ...
1
vote
1answer
96 views

Centos 6.5 auditd fails to start with service or /etc/init.d/audit start

Fail: # service auditd start Starting auditd: [FAILED] Fail: # /etc/init.d/auditd start Starting auditd: ...
0
votes
1answer
18 views

Logging SFTP activity with auditd

I am currently using auditd to log TTY activity for users that are SSH'd into my system. However, SFTP sessions are not logged in this way. Is there a way to log them using auditd or will I need to ...
0
votes
1answer
41 views

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset ...
0
votes
0answers
24 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
0
votes
0answers
15 views

Auditd on VM - disappearing rules

I have FTP virtual server on ESX with two virtual hard disks. That hard disk is a vmdk files on data store, not on local storage of VM host. One virtual hard disk is for system, second for FTP shares. ...
0
votes
2answers
85 views

Track any file changes using auditd

I try configure PCI REQ 10.5.5 "Use file integrity monitoring or change detection software on logs" Use auditd for this, rule "auditctl -w /tmp/testfile -p war" works perfectly. But if I try to use ...
0
votes
0answers
551 views

Disable auditd immutable mode without rebooting

Hello I've been tasked with fixing up a auditd policy but it's on a server that's actively being used and the policy installed was set immutable. I've tried searching and everyone recommends rebooting ...
1
vote
1answer
32 views

How to properly look for an info about auditd being turned off from init?

I have a mystery on my hands. One day /etc/rc5.d/S11auditd became /etc/rc5.d/K88auditd and no one takes responsibility for it. It looks like it just happened by itself, which is hardly plausible and ...
1
vote
1answer
96 views

Ignore specific types with auditd

I've recently been playing around with auditd and trying to cut out some of what it is logging. Here is my audit.rules entry to log execve # First rule - delete all -D -a always,exit -F arch=b64 -S ...
2
votes
1answer
208 views

log bash command centralized server or any auditd saas [duplicate]

I'm looking for a way to track our sysmin work, in the servers. Lets say sysmin 1 and sysmin 2 have access to any server but we need to make sure and track anything that they do in our server. ...
1
vote
0answers
65 views

How can I get auditd on RHEL6 to dispatch forwarded messages?

Using RHEL6, I currently have audispd setup to send logs to a remote server. The remote server successfully receives the messages, and writes them to the remote audit log. My problem is, I can't seem ...
0
votes
1answer
66 views

Logging violations of rules in limits.conf

I am trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system ...
1
vote
0answers
66 views

Ignoring auditing messages for particular PAM messages

I've got too many messages from PAM logging into audit.log, like this: type=USER_ACCT msg=audit(1378995943.792:867411): pid=4419 uid=0 auid=4294967295 ses=4294967295 ...
2
votes
1answer
2k views

How to install auditd on CentOS?

How to install auditd on CentOS 6.4 x64 ? I want to Log all commands run by admins Log all commands run by admins on production servers Edit: I can't run aduditd service I did with this tut enter ...
1
vote
1answer
87 views

How does fastCGI PHP alter a file and escape detection by auditd?

The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this: #!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer ...
1
vote
1answer
557 views

pam_tty_audit apparently not working

I just compiled pam_tty_audit module, because my Linux distro doesn't include it with the usual PAM modules. I included to the /etc/common-session the configuration line, as suggested in this ...
2
votes
1answer
78 views

Sudden new S11auditd in /etc/rc3.d

We have several machines running under Fedora 12. We have to deal with complete reinstallation quite often as our product comes with the whole distibution. I've noticed that sometimes soon after new ...
2
votes
1answer
305 views

Using auditd to watch a directory non-recursively?

I'm working on a Cent 6 Cpanel machine, and some mystery script is changing the permissions of home directories (!) to 777. I've ruled out all the easy fixes, so I just need to set up a watch on the ...
4
votes
2answers
476 views

Getting auditd to record the original user

This question is related to my previous question: Log all commands run by admins on production servers It is company policy for admins to login to the servers via a personal username, and then run ...
0
votes
1answer
498 views

How to check which processes are deleting files without using inotify or auditd? [closed]

I'm trying to figure out which processes are deleting files from a specific directory on my CentOS server. I looked at inotify, but all this does is to tell me how many file deletions are occurring; ...
2
votes
2answers
313 views

How to figure out which processes are deleting files from a specific directory?

I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run auditd on my system. I've set up the following rule in audit.rules: -w S unlink -S ...
2
votes
0answers
114 views

difference between success and failed event in auditd/aureport

The aureport command has two options that limit the list of displayed events to those that were successful and those that failed. Per the man page: --failed Only select failed events ...
1
vote
0answers
143 views

Unexpected jBoss crash and auditing signals

We're experiencing unexpected JBoss crashes on a semi-regular basis. JBoss 5 is running on RHEL6 in this case. I believe this is related to a sigusr1 sent to the JBoss process. The JBoss server logs ...
4
votes
1answer
538 views

pam_tty_audit and non privileged users

I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file: session ...
-1
votes
1answer
309 views

linux automatic change permissions in resolv.file

In various linux servers I see how the permissions of the /etc/resolv.conf file change automatically. In state normal: -r--r--r-- 1 root root 103 Jul 4 11:50 resolv.conf In changed state: ...
1
vote
1answer
647 views

auditd rule for number of logins

I am using Debian squeeze and installed auditd on it. When I run aureport it always shows Number of logins = 0 and Number of failed logins = 0. What rule should be added in audit rules for recording ...
2
votes
2answers
468 views

Auditing changes to the audit log

I have configured auditd for PCI compliance reasons PCI states that existing logs cannot be changed without generating an alert This article ...
1
vote
1answer
210 views

Why can't I run ausearch (part of auditd) remotely over SSH?

Any idea why the following doesn't work? It hangs with no output. desktop$ ssh myserver "sudo ausearch -k my_key" However, the following works. It outputs the auditing history of this key from ...
9
votes
6answers
1k views

Files disappearing on linux server

I've got 4 specific files that seem to keep disappearing from a user's home directory. As far as we know, there are no cronjobs or other automated tasks that would be removing them. I've setup auditd ...
5
votes
1answer
1k views

Suggestion for auditd set-up

I am trying to learn about securing a Linux box (I am using Ubuntu). Auditd is recommended for monitoring activities on the node. I have managed to install it, but I can't find much information about ...
1
vote
2answers
1k views

problem of setting audit rules: Syscall name unknown: stime

I am setting audit rules in /etc/audit/audit.rules. As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions. So I add one line into ...
1
vote
1answer
309 views

How can I pick up vsftpd logins with auditd and its prelude plugin?

I have a server running auditd and prelude with the audisdp-prelude plugin. Currently I get events for several types of logins, like sshd and gdm. However I don't seem to ever get login info for ...
6
votes
4answers
7k views

File audit in Linux: how to watch directory tree for deletions?

I have a forum script running on server and somehow small number of attachments begin to get lost. I want to find out what is deleting them and at what time. How can I setup Linux auditd (auditctl) to ...