Audit Your Way to Security: A Guide to Linux Auditing with auditd

 

Audit Your Way to Security: A Guide to Oracle Linux Auditing with auditd

Keeping your Linux secure requires vigilance. One essential tool for this task is auditd, the audit daemon. This blog post will serve as your guide to using auditd to track and analyze system activity on your Oracle Linux machine.

What is auditd?

Think of auditd as a watchful guardian, meticulously recording system events. These events can be anything from login attempts to file modifications. By analyzing these logs, you can identify potential security breaches and take appropriate action.

Getting Started with Auditd

Out of the box, Oracle Linux likely has the audit package pre-installed. If not, you can install it using sudo dnf install audit. The auditd service might also be running by default. You can check its status with sudo systemctl status auditd. If it's not running, use sudo service auditd start to get it going, and sudo systemctl enable auditd to ensure it starts automatically at boot.

Exploring Audit Logs and Rules

Audit logs are typically stored in /var/log/audit/audit.log. The rules that dictate which events are logged reside in /etc/audit/audit.rules. These rules are pre-configured, but you can customize them using the auditctl utility.

Customizing Audit Rules with auditctl

Let's say you want to keep a close eye on your SSH configuration file, /etc/ssh/sshd_config. You can use sudo auditctl -w /etc/ssh/sshd_config -p rwxa -k sshd_config to create a rule that monitors any attempts to read from, write to, or execute the file. This rule will be temporary, though.

Making it Permanent: Adding Custom Rules

To ensure your rule survives a reboot, you need to add it to a custom rule file placed in the /etc/audit/rules.d/ directory. For instance, you can create a file named my.rules and add the rule there.

Advanced Auditing with ausearch

Once you have audit logs, you'll want to analyze them. The ausearch command is your friend here. You can use it to search for specific events based on keywords or rules.

Keeping Your System Secure with Auditd

By effectively using auditd, you gain valuable insights into system activity. This allows you to detect potential security threats and take proactive measures to safeguard your [your_hostname] environment. Remember to explore the man pages for auditd, auditctl, and ausearch to delve deeper into their functionalities.

Happy and Secure Auditing!

 # Check if the audit package is installed
sudo dnf list installed "audit"

# Install the audit package if not installed
sudo dnf install -y audit

# Check the current status of auditd
sudo systemctl status auditd

# Start the auditd service
sudo service auditd start

# Enable auditd to start at boot time
sudo systemctl enable auditd

# Check the status of the kernel Audit subsystem
sudo auditctl -s

# Temporarily disable auditd
sudo auditctl -e 0

# Re-enable auditd
sudo auditctl -e 1

# View audit rules
sudo cat /etc/audit/audit.rules
sudo cat /etc/audit/rules.d/audit.rules

# Add an audit rule to log attempts to read or modify /etc/ssh/sshd_config
sudo auditctl -w /etc/ssh/sshd_config -p rwxa -k sshd_config

# Show current audit rules
sudo auditctl -l

# Add a permanent rule to /etc/audit/rules.d/my.rules
sudo tee /etc/audit/rules.d/my.rules > /dev/null <<'EOF'
-w /etc/ssh/sshd_config -p rwxa -k sshd_config
EOF

# Show the content of /etc/audit/rules.d/my.rules
sudo cat /etc/audit/rules.d/my.rules

# Search audit logs for the key sshd_config
sudo cat /var/log/audit/audit.log | grep sshd_config

# Search audit logs using ausearch
sudo ausearch --key sshd_config
sudo ausearch -i -k sshd_config

# Check if there are any rule changes to load
sudo augenrules --check

# Delete the previously added sshd_config custom rule
sudo auditctl -D -k sshd_config

# Merge the custom rule file
sudo augenrules --load

# Check active audit rules
sudo auditctl -l

# Add new rules to a new file /etc/audit/rules.d/new.rules
sudo tee /etc/audit/rules.d/new.rules > /dev/null <<'EOF'
-w /etc/passwd -p wa -k passwd_changes
-w /etc/selinux/ -p wa -k selinux_changes
EOF

# Load the new rules
sudo augenrules --load

# Re-check the active rules
sudo auditctl -l

# View the merged audit rules
sudo cat /etc/audit/audit.rules

# List files in /etc/audit
sudo ls -l /etc/audit

https://gist.github.com/Neo23x0/9fe88c0c5979e017a389b90fd19ddfee?permalink_comment_id=2394437

Auditing user activity on Linux is important for security, compliance, and troubleshooting. Here’s a comprehensive guide on how to audit user activity:

1. Why Audit User Activity?

• Security: Detect unauthorized access and potential security breaches.
• Compliance: Meet regulatory requirements (e.g., GDPR, HIPAA).
• Troubleshooting: Identify the cause of system issues.
• Accountability: Ensure users are responsible for their actions on the system.

2. What to Audit?

• User logins and logouts: Track who is accessing the system and when.
• Command execution: Monitor which commands are being executed.
• File access and modifications: Identify changes to critical files.
• Process creation: Observe processes started by users.
• System configuration changes: Keep track of modifications to system settings.

3. How to Audit?

Using auditd (Linux Auditing System)

Install auditd:

sudo yum install audit -y  # For Red Hat based systems
sudo systemctl enable auditd
sudo systemctl start auditd 

Configure Audit Rules:

-w /etc/passwd -p wa -k passwd_changes  # Monitor changes to /etc/passwd
-a always,exit -F arch=b64 -S execve -k commands  # Monitor all command executions 

Reload Audit Rules:

Using rsyslog for Authentication Logs

sudo auditctl -R /etc/audit/audit.rules

Configure rsyslog:

Ensure rsyslog is installed and running.

sudo yum install rsyslog -y
sudo systemctl enable rsyslog
sudo systemctl start rsyslog

Using last and lastb Commands

last
lastb  # For failed login attempts 

Search Audit Logs:

sudo ausearch -k commands  # Search for command execution logs
sudo ausearch -k passwd_changes  # Search for password file changes

Generate Audit Reports:

sudo aureport -au  # Authentication report
sudo aureport -x  # Executed command report

4. How to Analyze?

• Manual Analysis:

sudo grep "user" /var/log/audit/audit.log  # Find entries related to a specific user 

• Automated Analysis: Set up automated scripts or use third-party tools (e.g., Splunk, ELK Stack) to parse and analyze logs.

5. How to Improve?

• Regular Audits: Schedule regular audits to ensure ongoing compliance and security.
• Alerting: Set up alerts for suspicious activities using tools like auditd, rsyslog, or third-party monitoring solutions.
• Training: Train administrators on best practices for auditing and analyzing logs.
• Update Rules: Continuously update audit rules to cover new security threats and compliance requirements.

6. Here’s What Else to Consider

• Performance Impact: Excessive auditing can impact system performance. Balance the granularity of auditing with performance considerations.
• Storage Management: Ensure adequate log storage and implement log rotation to manage space.
• Security of Logs: Protect log files from unauthorized access and tampering. Use secure storage and transfer mechanisms.

By following these steps, you can effectively audit user activity on Linux systems, ensuring security, compliance, and efficient troubleshooting.

#OracleLinux #LinuxSecurity #Auditd #SecurityCompliance #SystemMonitoring #UserActivityAudit #LogAnalysis #redhat #oraclelinux