Audit - Security Auditing

Audit is an auditing tool on Linux, used to record actions taken on Linux. Through log files, we can track security events and identify abuse and unauthorized activity, including:

  • Tracking file access

  • Monitoring system calls

  • Recording command execution

  • Recording security events

  • Event search

  • Report summaries

  • Monitoring network access

Installation

apt install auditd

systemctl start auditd

The Audit system consists of two parts:

  1. The audit core component listens for system calls, records events, and sends messages to the audit daemon

  2. The audit daemon collects messages and writes entries out to the log file

Configuration

The configuration file is /etc/audit/auditd.conf [1]

  • num_logs: number of log files kept in rotation

  • max_log_file: size of a single log file

  • max_log_file_action: action triggered once the log size limit is reached

The rules file is /etc/audit/audit.rules

auditctl

auditctl controls the behavior of the audit system

-l

view audit rules

-w

add a file path

-p

specify the permissions that trigger auditing: r=read, w=write, x=execute, a=attribute

-k

set a keyword when adding a rule

Example

auditctl -w /etc/passwd -p rwxa

aureport

aureport generates a summary report from the logs

Example

Summary Report
======================
Range of time in logs: 12/22/2017 16:24:40.330 - 12/25/2017 15:37:57.867
Selected time for report: 12/22/2017 16:24:40 - 12/25/2017 15:37:57.867
Number of changes in configuration: 11
Number of changes to accounts, groups, or roles: 0
Number of logins: 0
Number of failed logins: 0
Number of authentications: 8
Number of failed authentications: 0
Number of users: 5
Number of terminals: 12
Number of host names: 6
...

ausearch

ausearch looks up audit events

-f

look up events based on file path

-m

look up events based on type

-a

look up events based on audit message ID

-k

look up events based on keyword

Example

ausearch -i -f /etc/passwd

type=PROCTITLE msg=audit(12/22/2017 17:01:10.706:180) : proctitle=rm
type=PATH msg=audit(12/22/2017 17:01:10.706:180) : item=1 name=config.py inode=111706342 dev=fe:05 mode=file,644 ouid=qc ogid=qc rdev=00:00 nametype=DELETE
type=PATH msg=audit(12/22/2017 17:01:10.706:180) : item=0 name=/opt inode=111706226 dev=fe:05 mode=dir,755 ouid=qc ogid=qc rdev=00:00 nametype=PARENT
type=CWD msg=audit(12/22/2017 17:01:10.706:180) :  cwd=/opt/config.py
type=SYSCALL msg=audit(12/22/2017 17:01:10.706:180) : arch=x86_64 syscall=unlinkat success=yes exit=0 a0=0xffffffffffffff9c a1=0x19bc0c0 a2=0x0 a3=0x7ffd05556870 items=2 ppid=67063 pid=68083 auid=lfzyx uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts2 ses=20178 comm=rm exe=/bin/rm key=qc

  • type: the audit message type

  • name: the audited object

  • arch: the CPU architecture

  • syscall: the system call type

  • success: whether the system call succeeded

  • ppid: the parent process ID

  • pid: the process ID

  • auid: the original UID

  • uid and gid: the user ID and group ID accessing the file

  • cwd: the current working directory

  • comm: the command that triggered this audit message

  • exe: the path of the command

  • key: the keyword defined by the rule [2]

References