Questions tagged [auditd]
auditd is the userspace component to the Linux Auditing System.
141
questions
0
votes
0answers
4 views
Issue with running Linux Audit System in a nested Virtual Machine inside Google Cloud Engine
I am trying to run the Linux audit system in a nested Virtual machine on the google cloud engine. The problem I am facing is that the Linux Audit System suspends after showing the following error ...
google-cloud-platform
1
vote
0answers
19 views
CentOS USER_CMD logs auditd
We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it?
We already getting commands, starting with sudo, but not ...
1
vote
0answers
25 views
Tracking TCP Connection in background
I am looking for a daemon utility to track all non local TCP connections and which binaries establish the TCP connections (actively and passively) with which IPs and ports.
auditd seems like a great ...
0
votes
0answers
25 views
auditd doesn't log reboot or shutdown commands
As mentioned in several guides online, in order to audit and monitor the reboot and shutdown commands on Centos7, you should have the following in your audit rules at
/etc/audit/rules.d/audit.rules
-a ...
1
vote
0answers
58 views
Filtering auditd log entries by msg content
I want to filter out this messages. They are generated by the user crontabs running every minute:
type=USER_END msg=audit(1611873842.675:459608): pid=19114 uid=0 auid=10061 ses=480462 subj==unconfined ...
0
votes
0answers
26 views
auditctl for missing files
I'm trying to record read access to missing files (unfortunately the application doesn't log such an info) and made a few,failed, tests with audictl.
Scenario:
I do not know the names of the files in ...
0
votes
1answer
26 views
selinux audit rule not logging anything
I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or ...
-1
votes
1answer
66 views
Email alert when private keys read from disk (honeypot, auditd)
I'd like to receive an immediate alert every time something reads the contents of my private key on Debian Linux. How can I do that?
I have an RSA private key stored on my server's disk at the ...
1
vote
0answers
77 views
Auditd to CloudwatchLogs to IDS alerts?
I'm administering a relatively simple AWS stack with about 5 heterogeneous Linux EC2 instances. All instances already have been setup to ship important logs to Cloudwatch Logs. Now I want to setup a ...
0
votes
0answers
17 views
Auditd - track commands (regular and sudo) of a given UID
I have some auditd rules like:
-a always,exit -F arch=b32 -S execve -F euid=1002 -k mytag
-a always,exit -F arch=b64 -S execve -F euid=1002 -k mytag
-a always,exit -F arch=b32 -S execve -F euid=1003 -...
0
votes
0answers
28 views
Is it possible to ensure detection and logging of all attempts to copy data out of a system?
Say I have a server set-up for processing sensitive data. The few authorised users of the system are instructed not to copy any of the sensitive data out of the platform, but could in principle do so ...
0
votes
0answers
305 views
How to get auditd started in CentOS Linux release 8.2.2004?
I did sudo yum reinstall audit on my server running CentOS Linux release 8.2.2004.
When I tried systemctl start auditd it failed. When I ran journalctl -xe I received the following output:
-- Unit ...
1
vote
1answer
1k views
RHEL: Splitting auditd logs into multiple files for different rules
We have an audit.rules defined and things in rules.d. Many of these are for RHEL CIS compliance and others are more specific for Docker CIS compliance.
One problem we are having is that certain rules ...
0
votes
0answers
21 views
How can I get auditctl to show me the bash script being run to create a file?
I have a simple bash script:
root@sophia:~# cat foo.sh
tmp=$(mktemp)
echo >$tmp Hello World
root@sophia:~#
If I run the bash script, it creates a tempfile and writes some stuff to it. It's not ...
0
votes
0answers
95 views
Why does auditd report UID 1001 is trying to mount a disk when Ubuntu upon boot?
I'm seeing a message from auditd I don't understand. My OS is Ubuntu 20.04.
Every time I boot the server, an audit entry says user id 1001 (a normal user) is making a syscall to /usr/bin/mount. But ...
0
votes
1answer
68 views
Auditd not sending to remote central server
I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server.
Note: instead of going to /etc/audisp/, these
...
0
votes
0answers
18 views
Suggestions for auditing screensaver unlocking
Our network includes several flavors of system, but all are CentOS 7 and all run either KDE or Gnome. I've implemented a rule:
-w /usr/lib64/security/pam_sss.so -p rwxa
And this works for KDE -- it ...
0
votes
1answer
680 views
I am trying to setup some auditd rules but getting error -F missing operation for auid
i am trying to setup the below rule in /etc/audit/audit.rules
-a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete
which didn't work so i tried ...
0
votes
1answer
112 views
use linux auditd to log absolute everything
im trying to audit an automated task that connect to my server and exec some commands.
I would like to know everything it does.
Currently Im trying these rules at my audit.rules file.
-a exit,always -...
1
vote
1answer
79 views
How can one identify what changes the SELinux file context of a file?
I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
0
votes
1answer
17 views
Conflic install package solution?
I need to install auditd from package because my CentOS 6.6 server can't use yum update. But I got some problem and can't install them:
rpm -i audit-libs-2.4.5-6.el6.i686.rpm audit-2.4.5-6.el6.i686....
0
votes
1answer
260 views
Auditing user activity when using SSH Certificates
I have been reading a lot lately on SSH Certificates and i love the advantages it brings.
Before investing time in building my own POC, i wanted to know how (if at all) would it be possible to audit ...
0
votes
1answer
23 views
Logging changes to file change/modify attributes
System is Centos8
I need to determine what process is touching a file without making any changes in content. I've tried auditctl but it does not seem to have a filesystem watch that can track these ...
0
votes
2answers
464 views
Disable cron messages in auditd
I can't seem to find a way to filter cron messages from auditd, no matter what rules I have in place. I'm using Ubuntu 18.04.3 LTS.
For example, even if my /etc/audit/audit.rules contains no rules:
-...
1
vote
0answers
19 views
Ubuntu - Don't apply audit policy for specific process
I am using a 3rd party logging service (LogDNA) to centralise my server logs, but the agent installed on the server is actually causing the generation of additional and unnecessary logs.
My audit ...
0
votes
1answer
111 views
How to configure auditd to collect logs from /proc kernel file directory
I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk.
To do this I need to be ...
1
vote
0answers
968 views
How can I control the audit backlog limit without the auditd package installed?
I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
1
vote
1answer
599 views
Configure auditd to monitor the execution of only one command
We have Ansible in place
I want to set up audit which logs who executes a play.. I want therefore only monitor the execution of the command ansible or ansible-playbook.
I can configure Ansible to ...
0
votes
1answer
139 views
Connections shows up in tcpdump but cannot not in auditd or ss
I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections.
I ...
0
votes
1answer
244 views
Debugging how symbolic link is getting broken in ubuntu?
I have a symbolic link of the form
ubuntu@platform1:~$ ls -lrt
total 28
drwxr-xr-x 4 ubuntu ubuntu 4096 Mar 2 15:02 deploy
lrwxrwxrwx 1 ubuntu ubuntu 14 May 25 18:27 logs -> /var/log/arkin
...
0
votes
1answer
847 views
Auditd Log all executions except some scripts
I configured my auditd to log all execve syscalls using these rules:
-a exit,always -F arch=b32 -S execve
-a exit,always -F arch=b64 -S execve
While this perfectly captures all activity of any user ...
3
votes
1answer
3k views
What's the difference between auid, uid, euid, suid, fsuid, obj_uid, gid, egid, sgid, fsgid, obj_gid in `auditctl`?
My server is centos7.6 with auditd 2.8.5
In audit rule, I set:
-a always,exit -F arch=b32 -S adjtimex,settimeofday -F key=time-change
But this rule also record normal ntpd activities,then I tried ...
0
votes
1answer
648 views
How can `auditd` log in `/var/log/audit/audit.log` even `auditctl -l` is empty?
My server is centos7.6
[root@localhost /]# auditctl -l
No rules
[root@localhost /]# cat /var/log/audit/audit.log
type=CRED_REFR msg=audit(1552434501.528:25860): pid=12659 uid=0 auid=0 ses=3578 msg='...
0
votes
0answers
421 views
Trying to enable auditd but svcadm not in solaris 10
I am new to Solaris.
environment: Solaris 10/ i386
Here's my problem:
I want to enable auditd to start generating system auditing log file. (Like service aduitd start in CentOS.)
And every guide I ...
4
votes
2answers
828 views
Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)
My auditd rules and my needs are fairly simple, I want only to log root actions.
# auditctl -l
-a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION
That is the only rule, and it works:
type=...
1
vote
0answers
519 views
Auditd how to exclude everything
I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant.
-a never,exclude -F msgtype=CWD
-a ...
2
votes
0answers
776 views
Auditd - log all ssh sessions
We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
0
votes
1answer
502 views
Record ssh REMOTE_USER in audit or history logs
In our company we usually have a single production user user and we ssh to our servers via pasword-less login with ssh keys.
Now, quite a few people work on those servers and sometimes we need to ...
1
vote
1answer
172 views
Permission denied when adding audit rule in audisp plugin
I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
2
votes
1answer
2k views
Name rotated auditd logs with date
Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have
audit.log
audit.log.1
audit.log.2
...
When audit.log fills up all of the files are rotated one number ...
1
vote
1answer
120 views
Audit file modifications over ssh in linux
I wanted to monitor all the modifications made to a file in a Linux server (Redhat). I made some research and found this auditing tool which I have already installed and configured using following ...
0
votes
1answer
132 views
auditlog filling up without any rules
I have set up certain audit rules however audit log is filling up with unnecessary events which I don't want to log. is there any way that auditd will log only defined rule-based logs.
OS: -Rhel 7.3
2
votes
2answers
1k views
How to determine process which makes DNS Request? [duplicate]
I have a server on AWS, GuardDuty started send me notifications:
*** "type":"Backdoor:EC2/C&CActivity.B!DNS",
*** {"domain":"libcurl.so","protocol":"UDP","blocked":false}
*** is querying a domain ...
0
votes
1answer
1k views
Using auditd and retaining log files for 6 months.
Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities
Task: Find a way to log all account management activities (e.g., account ...
3
votes
1answer
981 views
View auditd logs in journalctl
I'm using CentOS 7. trying to view auditd logs in journalctl
When I try journalctl -u auditd I see the following output:
-- Logs begin at Wed 2018-09-05 08:59:19 EDT, end at Wed 2018-09-19 15:01:01 ...
2
votes
3answers
551 views
Password change audit on solaris
Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts?
I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
0
votes
1answer
301 views
ausearch to filter audit logs to show only read, write , attribute changes in file
I want to filter audit logs for changes made to /etc/hosts file using ausearch (audit).
I can see multiple entries for single modify action for file in ausearch like syscall=chmod, syscall=open etc.
...
0
votes
0answers
439 views
How to view audit logs on the server
I'm trying to do a nfs share. I've configured the share.
Now I want to view the logs associated with the files in the nfs share.
I've created a centralized log server. I don't know the difference ...
0
votes
1answer
106 views
How to configure auditd to record all the activity from events which run with WinSCP
I have a requirement from a customer (I have no idea if it can be implemented, after days of searching). This is the request: "The auditlog rules should be extended for events (create, delete, update, ...
1
vote
1answer
2k views
Redirect Auditd.log data to rsyslog in RHEL-7
I would like to redirect the auditd log data into rsyslog instead of audit.log file.
I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to
...
