Auditoría en Linux

# yum install audit
# up2date install audit
# ntsysv
# chkconfig auditd on
# /etc/init.d/auditd start
# auditctl -w /etc/shadow -k shadow-file -p rwxa
# auditctl -w /tmp -p e -k webserver-watch-tmp
# auditctl -a entry,always -S all -F pid=1005
# ausearch -f /etc/passwd
# ausearch -f /etc/passwd | less
# ausearch -f /etc/passwd -i | less
type=PATH msg=audit(03/16/2007 14:52:59.985:55) : name=/etc/passwd flags=follow,open inode=23087346 dev=08:02 mode=file,644 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(03/16/2007 14:52:59.985:55) :  cwd=/webroot/home/lighttpd
type=FS_INODE msg=audit(03/16/2007 14:52:59.985:55) : inode=23087346 inode_uid=root inode_gid=root inode_dev=08:02 inode_rdev=00:00
type=FS_WATCH msg=audit(03/16/2007 14:52:59.985:55) : watch_inode=23087346 watch=passwd filterkey=password-file perm=read,write,append perm_mask=read
type=SYSCALL msg=audit(03/16/2007 14:52:59.985:55) : arch=x86_64 syscall=open success=yes exit=3 a0=7fbffffcb4 a1=0 a2=2 a3=6171d0 items=1 pid=12551 auid=unknown(4294967295) uid=lighttpd gid=lighttpd euid=lighttpd suid=lighttpd fsuid=lighttpd egid=lighttpd sgid=lighttpd fsgid=lighttpd comm=grep exe=/bin/grep
#!/usr/bin/perl
use strict;

# what do I want to look for in the audit log.
my $pattern = $ARGV[0];

# Define the audit directory if the user doesn't provide one.
my $dir = '/var/log/audit';
$dir = $ARGV[1] if scalar(@ARGV) == 2;

# Strip any trailing slash
$dir =~ s/\/$//g;

# walk through the directory and save the list of files as an array.
# find is nice because it gives you full path + executable
my @files = `sudo find $dir`;
# strip new lines from the array.
chomp(@files);

# loop through each element in the array and do something.
for my $file (@files)
{
  # declare the empty array before use
  my @arr;

  # determine if we use zgrep or grep
  # zgrep is needed for gz and grep is for regular files
  if ( $file =~ /gz$/ )
  { 
    @arr = `sudo zgrep $pattern $file`;
  }
  else
  {
    @arr = `sudo grep $pattern $file`;
  }

  # print the filename only if we found something in the file
  print "\nFile: $file\n" if ( scalar(@arr) > 0 );

  # for each element in the array translate epoch to human readable
  foreach(@arr)
  {
    chomp;
    # do a little regex for easy matching
    if ( /(.*msg=audit\()(\d+)(\.\d+:\d+.*)/ )
    {
      convert epoch to human readable
      my $td = scalar localtime $2;
      print "$1$td$3\n";
    }
  }
}
# cat /var/log/audit/audit.log | perl -pw -e "s/^*\d+\.\d+/localtime $&/e;"
log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
priority_boost = 4
flush = INCREMENTAL
freq = 20
num_logs = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file_action = keep_logs
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
##tcp_listen_port = 
tcp_listen_queue = 5
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320

# Archivos de configuracion de audit
-w /etc/audit/auditd.conf -p wa -k audit_conf
-w /etc/audit/audit.rules -p wa -k audit_conf
-w /etc/libaudit.conf     -p wa -k audit_conf
-w /etc/sysconfig/auditd  -p wa -k audit_conf

# Feel free to add below this line. See auditctl man page
-w /etc/fstab   -p wa -k filesystems
-w /etc/hosts   -p wa -k network

-w /etc/sysctl.conf -p wa -k sysctl_parameters
-w /etc/login.defs  -p wa -k auth
-w /etc/securetty   -p wa -k auth
-w /etc/sudoers     -p wa -k auth
-w /etc/security/limits.conf -p wa -k auth

# Actividades de sistema
-a entry,always -S chmod -S fchmod -S chown -S fchown -S lchown -k attr
-a entry,always -S mkdir -S rmdir -k attr
#-a entry,always -S unlink -S rename -S link -S symlink -k attr
#-a entry,always -S setxattr -k attr
#-a entry,always -S lsetxattr -k attr
#-a entry,always -S fsetxattr -k attr
#-a entry,always -S removexattr -k attr
#-a entry,always -S lremovexattr -k attr
#-a entry,always -S fremovexattr -k attr
-a entry,always -S mknod -k mknod
-a entry,always -S mount -k mount
-a entry,always -S umount2 -k umount
-a exit,always  -S setdomainname -k network

-w /etc/inittab -p wa 
-w /etc/init.d/
-w /etc/init.d/auditd -p wa 

# Librerias de sistema
-w /etc/ld.so.conf -p wa
-w /etc/localtime -p wa 

# Configuracion de modulos
#-w /etc/modprobe.d/
#-w /etc/modprobe.conf.local -p wa 
#-w /etc/modprobe.conf -p wa 

# Configuración de CRON
-w /etc/cron.allow -p wa 
-w /etc/cron.deny -p wa 
-w /etc/cron.d/ -p wa 
-w /etc/cron.daily/ -p wa 
-w /etc/cron.hourly/ -p wa 
-w /etc/cron.monthly/ -p wa 
-w /etc/cron.weekly/ -p wa 
-w /etc/crontab -p wa
-w /var/spool/cron/root

# --- Recomendaciones de la NSA
#- Records Events that Modify Date and Time Information
-a always,exit -S settimeofday -k time-change
-a always,exit -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change
#- Record Events that Modify User/Group Information
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
#- Record Events that Modify the System’s Network Environment
-a exit,always -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/sysconfig/network -p wa -k system-locale
#- Record Attempts to Alter Logon and Logout Events
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
#- Record Attempts to Alter Process and Session Initiation Information
-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session
#- Ensure auditd Collects Information on Kernel Module Loading and Unloading
#-w /sbin/insmod -p x -k modules
#-w /sbin/rmmod -p x -k modules
#-w /sbin/modprobe -p x -k modules
#-a always,exit -S init_module -S delete_module -k modules
#- Make the auditd Conﬁguration Immutable
#Add the following as the last rule in /etc/audit/audit.rules in order to make the conﬁguration immutable:
#-e 2
#With this setting, a reboot will be required to change any audit rules.
# aureport -l -i -ts yesterday -te today
# aureport --key --summary
# ausearch --key access --raw | aureport --file --summary
# ausearch --key access --file /etc/shadow --raw | aureport --user --summary -i
# ausearch --key access --raw | aureport -x --summary
# aureport --anomaly
# ausearch -ts today -k password-file
# ausearch -ts 3/12/07 -k password-file
# ausearch -ts today -k password-file -x rm
# ausearch -ts 3/12/07 -k password-file -x rm
# ausearch -ts today -k password-file -x rm -ui 506
# ausearch -k password-file -ui 506
auditctl -w /etc/fstab -p war -k someconfig-exclude -F auid!=0
auditctl -a entry,always -S all -F pid=1005
auditctl -a exit,always -S open -F auid=510
auditctl -a exit,always -S open -F success=0
auditctl -w /etc/shadow -p wa
auditctl -a exit,always -F path=/etc/shadow -F perm=wa
auditctl -w /etc/ -p wa
auditctl -a exit,always -F dir=/etc/ -F perm=wa

Tabla de Contenidos

Auditoría en Linux

Task: install audit package

How do I set a watch on a file for auditing?

File System audit rules

syscall audit rule

File system audit rule

syscall audit rule using pid

How do I find out who changed or accessed a file /etc/passwd?

Script parser de audit.log

Archivo de configuración de ejemplo

Reportes

Referencias útiles