Unit 8: Logs and the timeline · Lesson 6 of 8 · 18 min
Watching sensitive files with auditd
Logs show logins. The Linux audit system shows who changed which file. Read the rules web01 should have.
mission
- You are
- You are setting up file auditing for web01.
- Situation
- The kernel's audit system can record every write to a file you name, with the account that logged in originally, even after sudo.
- Goal
- Read the proposed rules and the summary of what they caught.
- Hand in
- One line per rule: what it watches and why.
Read the rules
-w watches a path, -p wa records writes and attribute changes, -k adds a search key.
cat /etc/audit/rules.d/web01.rules
-D
-b 8192
-f 1
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
-w /etc/ssh/sshd_config -p wa -k sshd
-w /etc/cron.d/ -p wa -k cron
-w /etc/systemd/system/ -p wa -k systemd
-w /etc/profile.d/ -p wa -k profile
you should see Watches on accounts, sudo, SSH, cron, systemd units and login scripts.
Count the watches
grep -c '^-w' /etc/audit/rules.d/web01.rules
9
you should see Nine paths.
Summarise what they caught
-if reads a saved log file, so you can review it without root.
aureport -if /var/log/audit/audit.log --key --summary
Key Summary Report
===========================
total key
===========================
2 identity
1 profile
1 cron
1 systemd
1 sudoers
you should see Six events across five keys.
Reading audit logs
| Command | What it does |
|---|---|
ausearch -k cron | Events tagged with a key |
ausearch -ua 1002 | Everything a login account did, even through sudo |
ausearch --success no | Attempts that were denied |
aureport --key --summary | Counts per key |
--format text | One readable sentence per event |
What a defender takes away
- 1Watch the files attackers change to stay.
- 2Keys make audit events searchable.
- 3auid keeps the original login name through sudo.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.