Auditd - Revision history

Nptskial at 17:07, 7 April 2017

2017-04-07T17:07:26Z

← Older revision		Revision as of 20:07, 7 April 2017
Line 78:		Line 78:

	[[File:Test4.PNG]]		[[File:Test4.PNG]]


	====Running summary reports====		====Running summary reports====
Line 87:		Line 88:

	[[File:Test5.PNG]]		[[File:Test5.PNG]]


	====Monitoring network access====		====Monitoring network access====
	The '''iptables''' and '''ebtables''' utilities can be configured to trigger Audit events, allowing system administrators to monitor network access.		The '''iptables''' and '''ebtables''' utilities can be configured to trigger Audit events, allowing system administrators to monitor network access.


	==Audit system architecture==		==Audit system architecture==

2017-04-07T17:06:40Z

Other Details

← Older revision		Revision as of 20:06, 7 April 2017
Line 514:		Line 514:
	Date created: March 11, 2017		Date created: March 11, 2017

	Last modification: ~~March 18~~, 2017		Last modification: April 7, 2017



	==References==		==References==

	[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]		[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]

2017-04-07T16:56:52Z

Running summary reports

← Older revision		Revision as of 19:56, 7 April 2017
Line 85:		Line 85:

	We will get the following output:		We will get the following output:

			[[File:Test5.PNG]]

	====Monitoring network access====		====Monitoring network access====

2017-04-07T16:56:13Z

Running summary reports

← Older revision		Revision as of 19:56, 7 April 2017
Line 80:		Line 80:

	====Running summary reports====		====Running summary reports====
	The '''aureport''' utility can be used to generate, among other things, daily reports of recorded events. A system administrator can then analyze these reports and investigate suspicious activity furthermore.		The '''aureport''' utility can be used to generate, among other things, daily reports of recorded events. A system administrator can then analyze these reports and investigate suspicious activity furthermore. For example, we can run the following command:

			<code># '''aureport --summary''' </code>

			We will get the following output:

	====Monitoring network access====		====Monitoring network access====
	The '''iptables''' and '''ebtables''' utilities can be configured to trigger Audit events, allowing system administrators to monitor network access.		The '''iptables''' and '''ebtables''' utilities can be configured to trigger Audit events, allowing system administrators to monitor network access.

2017-04-07T16:53:20Z

Searching for events

← Older revision		Revision as of 19:53, 7 April 2017
Line 75:		Line 75:
	<code># '''ausearch -ul 0''' </code>		<code># '''ausearch -ul 0''' </code>

	~~based~~ on the UID, in our case 0 which is an UID of root, we will get the following output:		Based on the UID, in our case 0 which is an UID of root, we will get the following output:

	[[File:Test4.PNG]]		[[File:Test4.PNG]]

2017-04-07T16:52:53Z

Searching for events

← Older revision		Revision as of 19:52, 7 April 2017
Line 76:		Line 76:

	based on the UID, in our case 0 which is an UID of root, we will get the following output:		based on the UID, in our case 0 which is an UID of root, we will get the following output:

			[[File:Test4.PNG]]

	====Running summary reports====		====Running summary reports====

2017-04-07T16:52:12Z

Searching for events

← Older revision		Revision as of 19:52, 7 April 2017
Line 71:		Line 71:

	====Searching for events====		====Searching for events====
	Audit provides the '''ausearch''' utility, which can be used to filter the log entries and provide a complete audit trail based on a number of conditions.		Audit provides the '''ausearch''' utility, which can be used to filter the log entries and provide a complete audit trail based on a number of conditions. For example, if we define a rule for watching '''test.txt''' file changes, change the file content and then run the following command:

			<code># '''ausearch -ul 0''' </code>

			based on the UID, in our case 0 which is an UID of root, we will get the following output:

	====Running summary reports====		====Running summary reports====
	The '''aureport''' utility can be used to generate, among other things, daily reports of recorded events. A system administrator can then analyze these reports and investigate suspicious activity furthermore.		The '''aureport''' utility can be used to generate, among other things, daily reports of recorded events. A system administrator can then analyze these reports and investigate suspicious activity furthermore.

2017-04-07T16:44:43Z

Use cases

← Older revision		Revision as of 19:44, 7 April 2017
Line 48:		Line 48:

	In the end of '''SYSCALL''' type log messages we can see string '''key="test_changes"''' which means that this message was triggered by the rule that we defined in the previous step.		In the end of '''SYSCALL''' type log messages we can see string '''key="test_changes"''' which means that this message was triggered by the rule that we defined in the previous step.


	====Monitoring system calls====		====Monitoring system calls====
Line 57:		Line 58:

	[[File:Test2.PNG]]		[[File:Test2.PNG]]


	====Recording commands run by a user====		====Recording commands run by a user====

2017-04-07T16:44:07Z

Use cases

← Older revision		Revision as of 19:44, 7 April 2017
Line 67:		Line 67:
	[[File:Test3.PNG]]		[[File:Test3.PNG]]

	~~====Recording security events====~~
	The '''pam_faillock''' authentication module is capable of recording failed login attempts. Audit can be set up to record failed login attempts as well, and provides additional information about the user who attempted to log in.
	====Searching for events====		====Searching for events====
	Audit provides the '''ausearch''' utility, which can be used to filter the log entries and provide a complete audit trail based on a number of conditions.		Audit provides the '''ausearch''' utility, which can be used to filter the log entries and provide a complete audit trail based on a number of conditions.
Line 75:		Line 74:
	====Monitoring network access====		====Monitoring network access====
	The '''iptables''' and '''ebtables''' utilities can be configured to trigger Audit events, allowing system administrators to monitor network access.		The '''iptables''' and '''ebtables''' utilities can be configured to trigger Audit events, allowing system administrators to monitor network access.



	==Audit system architecture==		==Audit system architecture==

2017-04-07T16:20:45Z

Recording commands run by a user

← Older revision		Revision as of 19:20, 7 April 2017
Line 62:		Line 62:

	<code># '''auditctl -a always,exit -F arch=b64 -S execve -k command-executed'''</code>		<code># '''auditctl -a always,exit -F arch=b64 -S execve -k command-executed'''</code>

			After executing '''rm''' command to remove a '''test.txt''' file created in previous examples, we get the following log messages in the log file:

			[[File:Test3.PNG]]

	====Recording security events====		====Recording security events====