Auditd

Auditd - is the userspace component of the Linux Auditing System. It is responsible for writing audit records to the disk. The Linux Auditing System helps system administrators to create an audit trail, a log for every action on the server. Since Auditd operates at the kernel level, this gives system administrators an opportunity to get detailed information about any system operation. The Linux Audit System provides a way to track security-relevant information on the system. Based on pre-configured rules, Auditd generates log entries to record as much information about the events that are happening on the system as possible. System administrators can choose which actions on the server should be monitored and to what extent. This information is crucial for mission-critical environments to determine the violator of the security policy and the actions they performed. Auditd does not provide additional security to the system, rather it can be used to discover violations of security policies used on the system. These violations can further be prevented by additional security measures such as SELinux. The Linux Audit System is developed and maintained by RedHat.

Usage and use cases

Usage

Auditd is a powerful tool for system administrators as it allows them to monitor access to any file, network traffic and almost everything they would need. The level of detail is phenomenal, since the daemon operates at kernel level and the granularity of the information has been proven to be very useful. The following list summarizes some of the information that Audit can record in its log files:

• Date and time, type, and outcome of an event.

• Sensitivity labels of subjects and objects.

• Association of an event with the identity of the user who triggered the event.

• All modifications to Audit configuration and attempts to access Audit log files.

• All uses of authentication mechanisms, such as SSH, Kerberos, and others.

• Changes to any trusted database, such as /etc/passwd.

• Attempts to import or export information into or from the system.

• Include or exclude events based on user identity, subject and object labels, and other attributes.

The use of Audit system is also a requirement for a number of security related certifications:

• Controlled Access Protection Profile (CAPP)

• Labeled Security Protection Profile (LSPP)

• Rule Set Base Access Control (RSBAC)

• National Industrial Security Program Operating Manual (NISPOM)

• Federal Information Security Management Act (FISMA)

• Payment Card Industry — Data Security Standard (PCI-DSS)

• Security Technical Implementation Guides (STIG)