Linux Audit System

Chapter 35: Linux Audit System

Comprehensive Guide to auditd

Why This Matters in DevOps/SRE

Audit logging is required for compliance and security investigations:

                 auditd for DevOps/SRE
+------------------------------------------------------------------+
|                                                                   |
|    Compliance:                                                      |
|    +----------------------------------------------------------+  |
|    | PCI-DSS → Track all access to cardholder data         |  |
|    | HIPAA → Audit access to PHI                            |  |
|    | SOX → Audit financial data access                      |  |
|    | SOC 2 → Audit trail for all system access              |  |
|    +----------------------------------------------------------+  |
|                                                                   |
|    Security Forensics:                                              |
|    +----------------------------------------------------------+  |
|    | Who accessed what → Individual accountability         |  |
|    | When → Timestamp of all actions                        |  |
|    | How → Command that was executed                       |  |
|    | Evidence → For incident investigations                |  |
|    +----------------------------------------------------------+  |
|                                                                   |
|    Real-time Monitoring:                                             |
|    +----------------------------------------------------------+  |
|    | aureport → Real-time reporting                        |  |
|    | ausearch → Query specific events                      |  |
|    | watchers → Automated alerting on suspicious activity   |  |
|    +----------------------------------------------------------+  |
|                                                                   |
+------------------------------------------------------------------+

Practical Impact:

Meet compliance requirements (PCI-DSS, HIPAA, SOC 2)
Investigate security incidents with evidence
Monitor privileged command usage
Detect insider threats

35.1 Understanding Linux Audit

What is auditd?

The Linux Audit system provides a framework for security auditing. It can track system events, file access, and user actions for compliance and security monitoring.

                 Audit System Components
+------------------------------------------------------------------+
|                                                                   |
|    Components:                                                     |
|    +----------------------------------------------------------+   |
|    | auditd     | Daemon that records audit events           |   |
|    | auditctl   | Command to control audit rules             |   |
|    | ausearch   | Search audit logs                          |   |
|    | aureport   | Generate audit reports                     |   |
|    | autrace   | Trace system calls                         |   |
|    | augenrules| Generate rules from /etc/audit/rules.d/    |   |
|    +----------------------------------------------------------+   |
|                                                                   |
|    Log Location: /var/log/audit/audit.log                         |
|                                                                   |
+------------------------------------------------------------------+

35.2 Installation and Configuration

# Install
sudo apt install auditd          # Debian/Ubuntu
sudo yum install audit           # RHEL/CentOS
sudo pacman -S audit            # Arch

# Start service
sudo systemctl enable --now auditd

# Configuration
# /etc/audit/auditd.conf
# /etc/audit/audit.rules
# /etc/audit/rules.d/*.rules

35.3 Audit Rules

File Monitoring

# Monitor password files
-w /etc/passwd -p wa -k password_file
-w /etc/shadow -p wa -k shadow_file
-w /etc/group -p wa -k group_file

# Monitor SSH
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /etc/ssh/ssh_config -p wa -k ssh_config

# Monitor sudo
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers_d

# Monitor system binaries
-w /usr/bin/sudo -p x -k sudo
-w /usr/bin/passwd -p x -k passwd
-w /usr/bin/su -p x -k su

# Monitor cron
-w /etc/cron.allow -p wa -k cron_allow
-w /etc/at.allow -p wa -k at_allow

# Monitor logs
-w /var/log/secure -p wa -k secure_log
-w /var/log/messages -p wa -k messages_log

System Call Monitoring

# Monitor execve calls
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/curl -k exec_curl
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/wget -k exec_wget

# Monitor file deletions
-a always,exit -F arch=b64 -S unlink -S unlinkat -k file_delete

# Monitor network connections
-a always,exit -F arch=b64 -S connect -k network_connect

# Monitor mount
-a always,exit -F arch=b64 -S mount -k mount

# Monitor chmod
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -k chmod

User Monitoring

# Monitor user sessions
-w /var/run/utmp -p wa -k user_session
-w /var/log/btmp -p wa -k failed_login
-w /var/log/wtmp -p wa -k login_log

# Monitor pam
-w /etc/pam.d/ -p wa -k pam

# Monitor shell config
-w /etc/profile -p wa -k profile
-w ~/.bashrc -p wa -k bashrc
-w ~/.bash_profile -p wa -k bash_profile

Loading Rules

# Reload rules
sudo auditctl -R /etc/audit/rules.d/security.rules

# Or use augenrules
sudo augenrules --load

# Check current rules
sudo auditctl -l

# Check rules (verbose)
sudo auditctl -s

35.4 Log Analysis

ausearch

# Search recent events
ausearch -ts recent
ausearch -ts today
ausearch -ts yesterday

# Search by key
ausearch -k password_file
ausearch -k sshd_config

# Search by user
ausearch -uid 1000
ausearch -username root

# Search by syscall
ausearch -sc execve
ausearch -sc connect

# Search by file
ausearch -f /etc/passwd

# Search failed events
ausearch -sc exit -sv no

# Combine options
ausearch -k password_file -ts recent -i

# Export to JSON
ausearch -k password_file --format json

aureport

# Summary
aureport --summary

# Events
aureport --event

# Files
aureport --file

# Users
aureport --user

# Failed events
aureport --failed

# Executables
aureport --executable

# Login/logout
aureport --login

# Generate report
aureport -te "Today" > /tmp/audit_report.txt

35.5 Real-time Monitoring

aureport with watch

# Live monitoring
aureport --tty -i | grep -E "root|admin"

# Using ausearch in loop
while true; do
  ausearch -k sudo -ts recent | tail -5
  sleep 10
done

# Using auditd with prtty
sudo auditctl -w /etc/passwd -p wa -k password_file
sudo autrace /bin/bash

35.6 Interview Questions

Basic Questions

What is the Linux Audit system?
- Framework for security event auditing
What is auditd?
- Daemon that records audit events
What do the audit rules -w and -p flags mean?
- -w = watch file, -p = permissions (rwx)
What is the audit log location?
- /var/log/audit/audit.log
What does -k mean in audit rules?
- Key for searching logs

Common Mistakes & Anti-Patterns

1. Not Configuring Audit Rules

# ❌ WRONG: Running auditd without custom rules
# Default rules don't track important files!

# ✅ CORRECT: Add essential audit rules
# /etc/audit/rules.d/security.rules
-w /etc/passwd -p wa -k passwd_modify
-w /etc/shadow -p wa -k shadow_modify
-w /etc/sudoers -p wa -k sudoers_modify
-w /usr/bin/sudo -p x -k sudo_exec
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/wget -k wget_exec

2. Ignoring Audit Log Rotation

# ❌ WRONG: Not configuring log rotation
# Disk fills up, auditd stops!

# ✅ CORORD: Configure proper rotation
# /etc/audit/auditd.conf
max_log_file = 50
max_log_file_action = ROTATE
num_logs = 5

3. Not Searching Audit Logs

# ❌ WRONG: Only looking at logs when breached
# Should regularly review for anomalies

# ✅ CORRECT: Regular log review
aureport --start this-week
# Find failed sudo attempts
ausearch -k sudo_exec -sv no
# Find file modifications
ausearch -k passwd_modify

4. Overly Verbose Rules

# ❌ WRONG: Auditing too much
-w / -p wa  # Logs EVERYTHING!
# System becomes extremely slow!

# ✅ CORRECT: Audit specific sensitive files only
-w /etc/passwd -p wa
-w /etc/shadow -p wa
-w /etc/sudoers -p wa
-w /var/log/ -p wa

Summary

                 Quick Reference
+------------------------------------------------------------------+
|                                                                   |
|    Commands:                                                       |
|    +----------------------------------------------------------+  |
|    | sudo auditctl -l               | List rules              |  |
|    | sudo auditctl -R               | Reload rules            |  |
|    | ausearch -k key               | Search by key          |  |
|    | aureport --summary             | Summary report         |  |
|    +----------------------------------------------------------+  |
|                                                                   |
|    Rule Flags:                                                    |
|    +----------------------------------------------------------+  |
|    | -w  | Watch file or directory                       |  |
|    | -p  | Permissions to watch (rwx)                     |  |
|    | -k  | Key for searching                              |  |
|    | -a  | Append rule                                   |  |
|    | -S  | Syscall                                       |  |
|    +----------------------------------------------------------+  |
|                                                                   |
+------------------------------------------------------------------+