Got Auditd? - Part 1
Setup auditing of sensitive files and folders to aid Linux endpoint investigations or simply keep tabs on users ( * or unexpected guests >:] *)
Intro
Have sensitive files and folders on a Linux file server? YES OF COURSE!
Do you wish you could keep an audit trail of any access to a specific file or folder? DEFINITELY!
In Part 1 of Got Auditd? we will configure auditd to monitor activities performed on your sensitive files and folders!
What is Auditd?
From the manpage (man auditd):
auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities. Configuring the audit system or loading rules is done with the auditctl utility. During startup, the rules in /etc/audit/audit.rules are read by auditctl and loaded into the kernel. Alternately, there is also an augenrules program that reads rules located in /etc/audit/rules.d/ and compiles them into an audit.rules file. The audit daemon itself has some configuration options that the admin may wish to customize. They are found in the auditd.conf file.
Configuration
Now let's go over a sample configuration to log any read write delete activity in a specific folder. We will be creating a file inside the /etc/audit/rules.d/ directory. We must not use the default /etc/audit/audit.rules as this file may be overwritten during an upgrade.
# /etc/audit/rules.d/data.rules
## Enable ruleset
-e 1
## Limit the rate to 120 audit entries per second
-r 120
## Monitor /opt/_data for rwxa events
-w /opt/_data -p rwxa -k toplevel_dataBelow is an explanation of each parameter:
-e #
1 - enables ruleset
2 - makes config immutable. Reboot is required to change configuration settings or rulesets.
-r #
limits the rate to # of audit entries per second
-w </path/to/file>
directory or file to monitor
-p <permissions>
Permissions:
r - read of the file w - write to the file x - execute the file a - change in the file's attribute
-k <keyname>
Keyname to use for the rule.
Testing
With the configuration now set, let's test it by creating a file, deleting it and listing the directory (click the image for better view):
Logs and reporting
Now that we have our configuration tested, let's use auditd's own tools for searching and reporting instead of grepping or tailing the log for activity!
To search the audit log, use auditd's built-in tool ausearch:
Seems like a lot of information right? We can use the aureport tool to interpret this log output!
Notes
Key Points to Keep in Mind About Auditd
Powerful File Activity Tracking: Auditd excels at monitoring activity on sensitive files. It provides visibility into who is performing the activity, when the activity is happening, and what files are being accessed, modified, written, or, in the worst case, deleted.
Audit Logs for Investigation and Detection: Audit logs and reports help track user activity and detect suspicious behavior. For example, if a sensitive file is deleted, audit logs can identify the responsible user, which is invaluable for investigations. Consider ingesting these logs into a SIEM for enhanced detection and alerting capabilities.
Configuration Testing Is Crucial: Always test your Auditd configurations before deploying them across your network. A misconfigured setup could create gaps in your monitoring timeline, leaving your system vulnerable.
References
Last updated