Questions tagged [auditd]
auditd is the userspace component to the Linux Auditing System.
129
questions
0
votes
0answers
13 views
Suggestions for auditing screensaver unlocking
Our network includes several flavors of system, but all are CentOS 7 and all run either KDE or Gnome. I've implemented a rule:
-w /usr/lib64/security/pam_sss.so -p rwxa
And this works for KDE -- it ...
0
votes
0answers
10 views
Auditd not logging sendto or sendmsg syscalls
We are presently updating some DNS Servers. Some processes persist in querying the old DNS after the /etc/resolv.conf which is to be expected as many processes cache resolv.conf
I create this auditd ...
0
votes
0answers
26 views
I am trying to setup some auditd rules but getting error -F missing operation for auid
i am trying to setup the below rule in /etc/audit/audit.rules
-a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>= 1000 -F auid!=4294967295 -k delete
which didn't work so i tried ...
0
votes
1answer
20 views
use linux auditd to log absolute everything
im trying to audit an automated task that connect to my server and exec some commands.
I would like to know everything it does.
Currently Im trying these rules at my audit.rules file.
-a exit,always -...
1
vote
1answer
25 views
How can one identify what changes the SELinux file context of a file?
I'm noticing some files within a web directory with changed file contexts that deviates from system policy. There are developers that run git pull against at a higher part of the web directory and I'm ...
0
votes
1answer
13 views
Conflic install package solution?
I need to install auditd from package because my CentOS 6.6 server can't use yum update. But I got some problem and can't install them:
rpm -i audit-libs-2.4.5-6.el6.i686.rpm audit-2.4.5-6.el6.i686....
0
votes
0answers
17 views
Linux auditd: reduce verbosity, filter out GDBus.Error
I get these messages once per minute. I would like to filter them out, or if possible to disable whoever process emits them to emit them.
Sample from /var/log/messages:
Feb 3 19:35:43 xyz journal[...
0
votes
1answer
91 views
Auditing user activity when using SSH Certificates
I have been reading a lot lately on SSH Certificates and i love the advantages it brings.
Before investing time in building my own POC, i wanted to know how (if at all) would it be possible to audit ...
0
votes
1answer
17 views
Logging changes to file change/modify attributes
System is Centos8
I need to determine what process is touching a file without making any changes in content. I've tried auditctl but it does not seem to have a filesystem watch that can track these ...
0
votes
1answer
99 views
Disable cron messages in auditd
I can't seem to find a way to filter cron messages from auditd, no matter what rules I have in place. I'm using Ubuntu 18.04.3 LTS.
For example, even if my /etc/audit/audit.rules contains no rules:
-...
0
votes
0answers
42 views
report generated by aureport has 'unset' as auid
An example line for the command,
/usr/sbin/aureport -l -i --success -ts yesterday
would be,
11/14/2019 06:00:00 unset 192.168.0.1 ssh /usr/sbin/sshd yes 10000000
or without -i,
11/14/2019 06:00:...
1
vote
0answers
14 views
Ubuntu - Don't apply audit policy for specific process
I am using a 3rd party logging service (LogDNA) to centralise my server logs, but the agent installed on the server is actually causing the generation of additional and unnecessary logs.
My audit ...
0
votes
0answers
16 views
Find sshd bash terminal using auditd rule, based on execve argument
I would like to log all executions of bash by sshd so I can ultimately find bash tty from sshd PID.
Using an auditd rule like like
auditctl -a always,exit -F arch=b64 -F exe="/usr/bin/bash" -S ...
0
votes
1answer
84 views
How to configure auditd to collect logs from /proc kernel file directory
I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk.
To do this I need to be ...
1
vote
0answers
364 views
How can I control the audit backlog limit without the auditd package installed?
I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
0
votes
1answer
337 views
Configure auditd to monitor the execution of only one command
We have Ansible in place
I want to set up audit which logs who executes a play.. I want therefore only monitor the execution of the command ansible or ansible-playbook.
I can configure Ansible to ...
0
votes
1answer
95 views
Connections shows up in tcpdump but cannot not in auditd or ss
I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections.
I ...
0
votes
1answer
150 views
Debugging how symbolic link is getting broken in ubuntu?
I have a symbolic link of the form
ubuntu@platform1:~$ ls -lrt
total 28
drwxr-xr-x 4 ubuntu ubuntu 4096 Mar 2 15:02 deploy
lrwxrwxrwx 1 ubuntu ubuntu 14 May 25 18:27 logs -> /var/log/arkin
...
0
votes
1answer
443 views
Auditd Log all executions except some scripts
I configured my auditd to log all execve syscalls using these rules:
-a exit,always -F arch=b32 -S execve
-a exit,always -F arch=b64 -S execve
While this perfectly captures all activity of any user ...
3
votes
1answer
2k views
What's the difference between auid, uid, euid, suid, fsuid, obj_uid, gid, egid, sgid, fsgid, obj_gid in `auditctl`?
My server is centos7.6 with auditd 2.8.5
In audit rule, I set:
-a always,exit -F arch=b32 -S adjtimex,settimeofday -F key=time-change
But this rule also record normal ntpd activities,then I tried ...
0
votes
1answer
360 views
How can `auditd` log in `/var/log/audit/audit.log` even `auditctl -l` is empty?
My server is centos7.6
[root@localhost /]# auditctl -l
No rules
[root@localhost /]# cat /var/log/audit/audit.log
type=CRED_REFR msg=audit(1552434501.528:25860): pid=12659 uid=0 auid=0 ses=3578 msg='...
0
votes
0answers
209 views
Trying to enable auditd but svcadm not in solaris 10
I am new to Solaris.
environment: Solaris 10/ i386
Here's my problem:
I want to enable auditd to start generating system auditing log file. (Like service aduitd start in CentOS.)
And every guide I ...
4
votes
2answers
383 views
Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)
My auditd rules and my needs are fairly simple, I want only to log root actions.
# auditctl -l
-a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION
That is the only rule, and it works:
type=...
1
vote
0answers
264 views
Auditd how to exclude everything
I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant.
-a never,exclude -F msgtype=CWD
-a ...
2
votes
0answers
444 views
Auditd - log all ssh sessions
We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
0
votes
1answer
383 views
Record ssh REMOTE_USER in audit or history logs
In our company we usually have a single production user user and we ssh to our servers via pasword-less login with ssh keys.
Now, quite a few people work on those servers and sometimes we need to ...
1
vote
1answer
143 views
Permission denied when adding audit rule in audisp plugin
I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit ...
1
vote
1answer
1k views
Name rotated auditd logs with date
Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have
audit.log
audit.log.1
audit.log.2
...
When audit.log fills up all of the files are rotated one number ...
1
vote
1answer
80 views
Audit file modifications over ssh in linux
I wanted to monitor all the modifications made to a file in a Linux server (Redhat). I made some research and found this auditing tool which I have already installed and configured using following ...
0
votes
1answer
116 views
auditlog filling up without any rules
I have set up certain audit rules however audit log is filling up with unnecessary events which I don't want to log. is there any way that auditd will log only defined rule-based logs.
OS: -Rhel 7.3
1
vote
2answers
451 views
How to determine process which makes DNS Request? [duplicate]
I have a server on AWS, GuardDuty started send me notifications:
*** "type":"Backdoor:EC2/C&CActivity.B!DNS",
*** {"domain":"libcurl.so","protocol":"UDP","blocked":false}
*** is querying a domain ...
0
votes
1answer
611 views
Using auditd and retaining log files for 6 months.
Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities
Task: Find a way to log all account management activities (e.g., account ...
1
vote
1answer
565 views
View auditd logs in journalctl
I'm using CentOS 7. trying to view auditd logs in journalctl
When I try journalctl -u auditd I see the following output:
-- Logs begin at Wed 2018-09-05 08:59:19 EDT, end at Wed 2018-09-19 15:01:01 ...
2
votes
3answers
439 views
Password change audit on solaris
Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts?
I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
0
votes
1answer
238 views
ausearch to filter audit logs to show only read, write , attribute changes in file
I want to filter audit logs for changes made to /etc/hosts file using ausearch (audit).
I can see multiple entries for single modify action for file in ausearch like syscall=chmod, syscall=open etc.
...
0
votes
0answers
382 views
How to view audit logs on the server
I'm trying to do a nfs share. I've configured the share.
Now I want to view the logs associated with the files in the nfs share.
I've created a centralized log server. I don't know the difference ...
0
votes
1answer
68 views
How to configure auditd to record all the activity from events which run with WinSCP
I have a requirement from a customer (I have no idea if it can be implemented, after days of searching). This is the request: "The auditlog rules should be extended for events (create, delete, update, ...
1
vote
1answer
2k views
Redirect Auditd.log data to rsyslog in RHEL-7
I would like to redirect the auditd log data into rsyslog instead of audit.log file.
I see that by default in the /etc/audit/auditd.conf the following line has been included to redirect it to
...
1
vote
2answers
345 views
Linux SSH audit for failed root login
Let's assume there are two servers ( Server A and Server B ). I am seeing root ssh failed login attempted from Server A to Server B. ssh for root login has been disabled for both of the severs.
I ...
1
vote
0answers
112 views
auditctl doesn't stores reads
So I have this rule on auditctl:
-w /home/ec2-user/myfile -p rwa -k key-name
But when I run
ausearch -f /home/ec2-user/myfile
or check the logs in /var/log/audit/audit.log, I can't see any ...
1
vote
1answer
82 views
Can auditd logs be modified? (Security, shell monitoring)
I recently set up auditd and enabled TTY logging so I could give someone non-root shell access and monitor what they're doing. (For what it's worth I gave them jailshell access, a cPanel feature that ...
0
votes
0answers
343 views
Restart of auditd causes audispd reconfigure infinite loop
We restart some of our services on Debian jessie every night at 11:45 PM as part of logfile rotation. Among those services that we restart is the auditd service. We are sometimes seeing that audispd ...
1
vote
0answers
43 views
Ubuntu 14.04.5 Need To Know If/When auditd Stops/Crashes
I have a security requirement to take some action (halt or reboot to single user mode) when/if auditd stops or crashes. I have set up auditd.conf to handle running out of disk space. Somehow I don't ...
1
vote
0answers
293 views
Solaris 11 Auditing, audit_control file cannot be found
First of all I would like to say I'm not a Linux/Solaris guy, but just assigned task to look at 1 particular item in hardening checklist, so thinking to seek help here to understand more.
From the ...
0
votes
1answer
34 views
auditd cache activity filtering?
Can anyone suggest a strategy for filtering browser cache activity from auditable events in CentOS6. Apparently el7 has added capabilities for filtering on executables? But all of our workstation ...
1
vote
1answer
154 views
auditctl: Error - nested rule files not supported
I'm trying to list the rules in a rules file using auditctl, whenever I do: auditctl -R audit.rules -l; I receive the error Error - nested rule files not supported. I've gone so far as to empty the ...
0
votes
1answer
745 views
How to stop syslog or auditd/ audisp from adding host information to forwarded log files? [duplicate]
I have forwarded the auditd log files to central log server but the log received at the central log server have extra information added to it which I dont want. Note (auditd and syslog are on same ...
0
votes
1answer
176 views
Why does auditd only log `echo` when I use the absolute path?
Info
Running auditd version 2.6.5 on Centos 7.
My rules file contains:
-a exit,always -F arch=b64 -F auid=0 -S execve -k root_action
-a exit,always -F arch=b32 -F auid=0 -S execve -k root_action
...
0
votes
0answers
43 views
Is there anyway to log all system calls with DTrace?
I installed DTrace on Ubuntu by the following command:
sudo apt-get install systemtap-sdt-dev
Is there anyway to log all system calls with DTrace (it is possible by auditd but it crashes after 20 ...
2
votes
1answer
6k views
Problems with auditd rules files
I have a problem generating auditd rules on CentOS 7.
I have 2 .rules files in my /etc/audit/rules.d/ directory. Both files are owned by root and only root has access. When I reload the rules using ...
