Questions tagged [auditd]

auditd is the userspace component to the Linux Auditing System.

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

Suggestions for auditing screensaver unlocking

Our network includes several flavors of system, but all are CentOS 7 and all run either KDE or Gnome. I've implemented a rule: -w /usr/lib64/security/pam_sss.so -p rwxa And this works for KDE -- it ...
0
votes
0answers
10 views

Auditd not logging sendto or sendmsg syscalls

We are presently updating some DNS Servers. Some processes persist in querying the old DNS after the /etc/resolv.conf which is to be expected as many processes cache resolv.conf I create this auditd ...
0
votes
0answers
26 views

I am trying to setup some auditd rules but getting error -F missing operation for auid

i am trying to setup the below rule in /etc/audit/audit.rules -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete which didn't work so i tried ...
0
votes
1answer
20 views

use linux auditd to log absolute everything

im trying to audit an automated task that connect to my server and exec some commands. I would like to know everything it does. Currently Im trying these rules at my audit.rules file. -a exit,always -...
1
vote
1answer
25 views

How can one identify what changes the SELinux file context of a file?

I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
0
votes
1answer
13 views

Conflic install package solution?

I need to install auditd from package because my CentOS 6.6 server can't use yum update. But I got some problem and can't install them: rpm -i audit-libs-2.4.5-6.el6.i686.rpm audit-2.4.5-6.el6.i686....
0
votes
0answers
17 views

Linux auditd: reduce verbosity, filter out GDBus.Error

I get these messages once per minute. I would like to filter them out, or if possible to disable whoever process emits them to emit them. Sample from /var/log/messages: Feb 3 19:35:43 xyz journal[...
0
votes
1answer
91 views

Auditing user activity when using SSH Certificates

I have been reading a lot lately on SSH Certificates and i love the advantages it brings. Before investing time in building my own POC, i wanted to know how (if at all) would it be possible to audit ...
0
votes
1answer
17 views

Logging changes to file change/modify attributes

System is Centos8 I need to determine what process is touching a file without making any changes in content. I've tried auditctl but it does not seem to have a filesystem watch that can track these ...
0
votes
1answer
99 views

Disable cron messages in auditd

I can't seem to find a way to filter cron messages from auditd, no matter what rules I have in place. I'm using Ubuntu 18.04.3 LTS. For example, even if my /etc/audit/audit.rules contains no rules: -...
0
votes
0answers
42 views

report generated by aureport has 'unset' as auid

An example line for the command, /usr/sbin/aureport -l -i --success -ts yesterday would be, 11/14/2019 06:00:00 unset 192.168.0.1 ssh /usr/sbin/sshd yes 10000000 or without -i, 11/14/2019 06:00:...
1
vote
0answers
14 views

Ubuntu - Don't apply audit policy for specific process

I am using a 3rd party logging service (LogDNA) to centralise my server logs, but the agent installed on the server is actually causing the generation of additional and unnecessary logs. My audit ...
0
votes
0answers
16 views

Find sshd bash terminal using auditd rule, based on execve argument

I would like to log all executions of bash by sshd so I can ultimately find bash tty from sshd PID. Using an auditd rule like like auditctl -a always,exit -F arch=b64 -F exe="/usr/bin/bash" -S ...
0
votes
1answer
84 views

How to configure auditd to collect logs from /proc kernel file directory

I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk. To do this I need to be ...
1
vote
0answers
364 views

How can I control the audit backlog limit without the auditd package installed?

I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
0
votes
1answer
337 views

Configure auditd to monitor the execution of only one command

We have Ansible in place I want to set up audit which logs who executes a play.. I want therefore only monitor the execution of the command ansible or ansible-playbook. I can configure Ansible to ...
0
votes
1answer
95 views

Connections shows up in tcpdump but cannot not in auditd or ss

I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections. I ...
0
votes
1answer
150 views

Debugging how symbolic link is getting broken in ubuntu?

I have a symbolic link of the form ubuntu@platform1:~$ ls -lrt total 28 drwxr-xr-x 4 ubuntu ubuntu 4096 Mar 2 15:02 deploy lrwxrwxrwx 1 ubuntu ubuntu 14 May 25 18:27 logs -> /var/log/arkin ...
0
votes
1answer
443 views

Auditd Log all executions except some scripts

I configured my auditd to log all execve syscalls using these rules: -a exit,always -F arch=b32 -S execve -a exit,always -F arch=b64 -S execve While this perfectly captures all activity of any user ...
3
votes
1answer
2k views

What's the difference between auid, uid, euid, suid, fsuid, obj_uid, gid, egid, sgid, fsgid, obj_gid in `auditctl`?

My server is centos7.6 with auditd 2.8.5 In audit rule, I set: -a always,exit -F arch=b32 -S adjtimex,settimeofday -F key=time-change But this rule also record normal ntpd activities,then I tried ...
0
votes
1answer
360 views

How can `auditd` log in `/var/log/audit/audit.log` even `auditctl -l` is empty?

My server is centos7.6 [root@localhost /]# auditctl -l No rules [root@localhost /]# cat /var/log/audit/audit.log type=CRED_REFR msg=audit(1552434501.528:25860): pid=12659 uid=0 auid=0 ses=3578 msg='...
0
votes
0answers
209 views

Trying to enable auditd but svcadm not in solaris 10

I am new to Solaris. environment: Solaris 10/ i386 Here's my problem: I want to enable auditd to start generating system auditing log file. (Like service aduitd start in CentOS.) And every guide I ...
4
votes
2answers
383 views

Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)

My auditd rules and my needs are fairly simple, I want only to log root actions. # auditctl -l -a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION That is the only rule, and it works: type=...
1
vote
0answers
264 views

Auditd how to exclude everything

I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant. -a never,exclude -F msgtype=CWD -a ...
2
votes
0answers
444 views

Auditd - log all ssh sessions

We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
0
votes
1answer
383 views

Record ssh REMOTE_USER in audit or history logs

In our company we usually have a single production user user and we ssh to our servers via pasword-less login with ssh keys. Now, quite a few people work on those servers and sometimes we need to ...
1
vote
1answer
143 views

Permission denied when adding audit rule in audisp plugin

I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
1
vote
1answer
1k views

Name rotated auditd logs with date

Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have audit.log audit.log.1 audit.log.2 ... When audit.log fills up all of the files are rotated one number ...
1
vote
1answer
80 views

Audit file modifications over ssh in linux

I wanted to monitor all the modifications made to a file in a Linux server (Redhat). I made some research and found this auditing tool which I have already installed and configured using following ...
0
votes
1answer
116 views

auditlog filling up without any rules

I have set up certain audit rules however audit log is filling up with unnecessary events which I don't want to log. is there any way that auditd will log only defined rule-based logs. OS: -Rhel 7.3
1
vote
2answers
451 views

How to determine process which makes DNS Request? [duplicate]

I have a server on AWS, GuardDuty started send me notifications: *** "type":"Backdoor:EC2/C&CActivity.B!DNS", *** {"domain":"libcurl.so","protocol":"UDP","blocked":false} *** is querying a domain ...
0
votes
1answer
611 views

Using auditd and retaining log files for 6 months.

Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities Task: Find a way to log all account management activities (e.g., account ...
1
vote
1answer
565 views

View auditd logs in journalctl

I'm using CentOS 7. trying to view auditd logs in journalctl When I try journalctl -u auditd I see the following output: -- Logs begin at Wed 2018-09-05 08:59:19 EDT, end at Wed 2018-09-19 15:01:01 ...
2
votes
3answers
439 views

Password change audit on solaris

Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts? I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
0
votes
1answer
238 views

ausearch to filter audit logs to show only read, write , attribute changes in file

I want to filter audit logs for changes made to /etc/hosts file using ausearch (audit). I can see multiple entries for single modify action for file in ausearch like syscall=chmod, syscall=open etc. ...
0
votes
0answers
382 views

How to view audit logs on the server

I'm trying to do a nfs share. I've configured the share. Now I want to view the logs associated with the files in the nfs share. I've created a centralized log server. I don't know the difference ...
0
votes
1answer
68 views

How to configure auditd to record all the activity from events which run with WinSCP

I have a requirement from a customer (I have no idea if it can be implemented, after days of searching). This is the request: "The auditlog rules should be extended for events (create, delete, update, ...
1
vote
1answer
2k views

Redirect Auditd.log data to rsyslog in RHEL-7

I would like to redirect the auditd log data into rsyslog instead of audit.log file. I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to ...
1
vote
2answers
345 views

Linux SSH audit for failed root login

Let's assume there are two servers ( Server A and Server B ). I am seeing root ssh failed login attempted from Server A to Server B. ssh for root login has been disabled for both of the severs. I ...
1
vote
0answers
112 views

auditctl doesn't stores reads

So I have this rule on auditctl: -w /home/ec2-user/myfile -p rwa -k key-name But when I run ausearch -f /home/ec2-user/myfile or check the logs in /var/log/audit/audit.log, I can't see any ...
1
vote
1answer
82 views

Can auditd logs be modified? (Security, shell monitoring)

I recently set up auditd and enabled TTY logging so I could give someone non-root shell access and monitor what they're doing. (For what it's worth I gave them jailshell access, a cPanel feature that ...
0
votes
0answers
343 views

Restart of auditd causes audispd reconfigure infinite loop

We restart some of our services on Debian jessie every night at 11:45 PM as part of logfile rotation. Among those services that we restart is the auditd service. We are sometimes seeing that audispd ...
1
vote
0answers
43 views

Ubuntu 14.04.5 Need To Know If/When auditd Stops/Crashes

I have a security requirement to take some action (halt or reboot to single user mode) when/if auditd stops or crashes. I have set up auditd.conf to handle running out of disk space. Somehow I don't ...
1
vote
0answers
293 views

Solaris 11 Auditing, audit_control file cannot be found

First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more. From the ...
0
votes
1answer
34 views

auditd cache activity filtering?

Can anyone suggest a strategy for filtering browser cache activity from auditable events in CentOS6. Apparently el7 has added capabilities for filtering on executables? But all of our workstation ...
1
vote
1answer
154 views

auditctl: Error - nested rule files not supported

I'm trying to list the rules in a rules file using auditctl, whenever I do: auditctl -R audit.rules -l; I receive the error Error - nested rule files not supported. I've gone so far as to empty the ...
0
votes
1answer
745 views

How to stop syslog or auditd/ audisp from adding host information to forwarded log files? [duplicate]

I have forwarded the auditd log files to central log server but the log received at the central log server have extra information added to it which I dont want. Note (auditd and syslog are on same ...
0
votes
1answer
176 views

Why does auditd only log `echo` when I use the absolute path?

Info Running auditd version 2.6.5 on Centos 7. My rules file contains: -a exit,always -F arch=b64 -F auid=0 -S execve -k root_action -a exit,always -F arch=b32 -F auid=0 -S execve -k root_action ...
0
votes
0answers
43 views

Is there anyway to log all system calls with DTrace?

I installed DTrace on Ubuntu by the following command: sudo apt-get install systemtap-sdt-dev Is there anyway to log all system calls with DTrace (it is possible by auditd but it crashes after 20 ...
2
votes
1answer
6k views

Problems with auditd rules files

I have a problem generating auditd rules on CentOS 7. I have 2 .rules files in my /etc/audit/rules.d/ directory. Both files are owned by root and only root has access. When I reload the rules using ...