I will argue with @Michael Hampton, about making all the rules in the format that he suggested. But I will agree with him on get guidance from the man page of the Linux Audit Kernel [1].
According to the manual, there are 3 types of rules control
, file
(Which is what @RedTedRedemption is trying to do) and system calls
(Which is what @Michael is suggesting)
In your rule to track the modifications on the file of read, write, and change of permissions you need to add the modifier -p
with these options:
w = write
a = change permissions or access
r = read
I think @RedTedRedemption is on the right path, setting up a rule to watch for modifications in a specific directory.
However, you need to establish this rule as permanent in the audit.rules file under /etc/audit/
directory. Otherwise, every time the audit daemon restarts, or the server restarts, the default rules will be applied again, and your settings will no longer be logging to the /var/log/audit/audit.log
file.
To set up your rule to watch for the directory permanently, this is the line that you must type over the rules setting file under /etc/audit/audit.rules
-w </your/file/path> -p war -k <your-key>
In addition, you need to comment or delete these rules from there too:
# First rule – delete all
#-D
# Disable system call auditing.
# Remove the following line if you need the auditing.
#-a never,task
Because the above control
rules are overriding and deleting all following rules on reload
And then, when you apply your changes to the audit.rules, run these commands:
service auditd reload
or systemctl auditd reload
service auditd restart
or systemctl auditd restart
Finally, to query for audit logs related to your rule you will need to run these commands:
sudo ausearch -i -k <your-key>
-> To search for events related to your rule key
sudo aureport -k
-> To print in screen an audit report organized by rule’s keys
sudo aureport -f
-> To print in screen an audit report organized by file’s names
References:
https://linux.die.net/man/7/audit.rules [1]