Audit_system

Chapter 35: Linux Audit System

Comprehensive Guide to auditd

34.1 Understanding Linux Audit

What is auditd?

The Linux Audit system provides a framework for security auditing. It can track system events, file access, and user actions for compliance and security monitoring.

                 Audit System Components
+------------------------------------------------------------------+
|                                                                   |
|    Components:                                                     |
|    +----------------------------------------------------------+   |
|    | auditd     | Daemon that records audit events           |   |
|    | auditctl   | Command to control audit rules             |   |
|    | ausearch   | Search audit logs                          |   |
|    | aureport   | Generate audit reports                     |   |
|    | autrace   | Trace system calls                         |   |
|    | augenrules| Generate rules from /etc/audit/rules.d/    |   |
|    +----------------------------------------------------------+   |
|                                                                   |
|    Log Location: /var/log/audit/audit.log                         |
|                                                                   |
+------------------------------------------------------------------+

34.2 Installation and Configuration

# Install
sudo apt install auditd          # Debian/Ubuntu
sudo yum install audit           # RHEL/CentOS
sudo pacman -S audit            # Arch

# Start service
sudo systemctl enable --now auditd

# Configuration
# /etc/audit/auditd.conf
# /etc/audit/audit.rules
# /etc/audit/rules.d/*.rules

34.3 Audit Rules

File Monitoring

# Monitor password files
-w /etc/passwd -p wa -k password_file
-w /etc/shadow -p wa -k shadow_file
-w /etc/group -p wa -k group_file

# Monitor SSH
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /etc/ssh/ssh_config -p wa -k ssh_config

# Monitor sudo
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers_d

# Monitor system binaries
-w /usr/bin/sudo -p x -k sudo
-w /usr/bin/passwd -p x -k passwd
-w /usr/bin/su -p x -k su

# Monitor cron
-w /etc/cron.allow -p wa -k cron_allow
-w /etc/at.allow -p wa -k at_allow

# Monitor logs
-w /var/log/secure -p wa -k secure_log
-w /var/log/messages -p wa -k messages_log

System Call Monitoring

# Monitor execve calls
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/curl -k exec_curl
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/wget -k exec_wget

# Monitor file deletions
-a always,exit -F arch=b64 -S unlink -S unlinkat -k file_delete

# Monitor network connections
-a always,exit -F arch=b64 -S connect -k network_connect

# Monitor mount
-a always,exit -F arch=b64 -S mount -k mount

# Monitor chmod
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -k chmod

User Monitoring

# Monitor user sessions
-w /var/run/utmp -p wa -k user_session
-w /var/log/btmp -p wa -k failed_login
-w /var/log/wtmp -p wa -k login_log

# Monitor pam
-w /etc/pam.d/ -p wa -k pam

# Monitor shell config
-w /etc/profile -p wa -k profile
-w ~/.bashrc -p wa -k bashrc
-w ~/.bash_profile -p wa -k bash_profile

Loading Rules

# Reload rules
sudo auditctl -R /etc/audit/rules.d/security.rules

# Or use augenrules
sudo augenrules --load

# Check current rules
sudo auditctl -l

# Check rules (verbose)
sudo auditctl -s

34.4 Log Analysis

ausearch

# Search recent events
ausearch -ts recent
ausearch -ts today
ausearch -ts yesterday

# Search by key
ausearch -k password_file
ausearch -k sshd_config

# Search by user
ausearch -uid 1000
ausearch -username root

# Search by syscall
ausearch -sc execve
ausearch -sc connect

# Search by file
ausearch -f /etc/passwd

# Search failed events
ausearch -sc exit -sv no

# Combine options
ausearch -k password_file -ts recent -i

# Export to JSON
ausearch -k password_file --format json

aureport

# Summary
aureport --summary

# Events
aureport --event

# Files
aureport --file

# Users
aureport --user

# Failed events
aureport --failed

# Executables
aureport --executable

# Login/logout
aureport --login

# Generate report
aureport -te "Today" > /tmp/audit_report.txt

34.5 Real-time Monitoring

aureport with watch

# Live monitoring
aureport --tty -i | grep -E "root|admin"

# Using ausearch in loop
while true; do
  ausearch -k sudo -ts recent | tail -5
  sleep 10
done

# Using auditd with prtty
sudo auditctl -w /etc/passwd -p wa -k password_file
sudo autrace /bin/bash

34.6 Interview Questions

Basic Questions

What is the Linux Audit system?
- Framework for security event auditing
What is auditd?
- Daemon that records audit events
What do the audit rules -w and -p flags mean?
- -w = watch file, -p = permissions (rwx)
What is the audit log location?
- /var/log/audit/audit.log
What does -k mean in audit rules?
- Key for searching logs

Summary

                 Quick Reference
+------------------------------------------------------------------+
|                                                                   |
|    Commands:                                                       |
|    +----------------------------------------------------------+  |
|    | sudo auditctl -l               | List rules              |  |
|    | sudo auditctl -R               | Reload rules            |  |
|    | ausearch -k key               | Search by key          |  |
|    | aureport --summary             | Summary report         |  |
|    +----------------------------------------------------------+  |
|                                                                   |
|    Rule Flags:                                                    |
|    +----------------------------------------------------------+  |
|    | -w  | Watch file or directory                       |  |
|    | -p  | Permissions to watch (rwx)                     |  |
|    | -k  | Key for searching                              |  |
|    | -a  | Append rule                                   |  |
|    | -S  | Syscall                                       |  |
|    +----------------------------------------------------------+  |
|                                                                   |
+------------------------------------------------------------------+