10:53 a.m.
I think there are a few ways you can do this with auditd:
(These both assume you've setup pam_loginuid)
If your admins are a finite set of uids, you could do something like
auditctl -a exit,always -F auid=<admin1> -F success=1
auditctl -a exit,always -F auid=<admin2> -F success=1
...
auditctl -a exit,always -F auid=<adminN> -F success=1
or if by administrators you mean actions run as root (eg, with sudo or
su), you can do something like
auditctl -a exit,always -F auid=!0 -F euid=0 -F success=1
You'll probably want to restrict which syscalls you care about, eg
open/execve/chmod/unlink whatever. Those rules as they're written will
log a lot more than you likely want.
On Wed, Feb 8, 2012 at 6:30 AM, Jender, Raymond [USA]
<jender_raymond(a)bah.com> wrote:
How would you set up audit.rules to log any action by
administrators?
Thanks,
Ray
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
--
Peter Moody Google 1.650.253.7306
Security Engineer pgp:0xC3410038
12:40 p.m.
On Wednesday, February 08, 2012 11:53:44 AM Peter Moody wrote:
I think there are a few ways you can do this with auditd:
(These both assume you've setup pam_loginuid)
If your admins are a finite set of uids, you could do something like
auditctl -a exit,always -F auid=<admin1> -F success=1
auditctl -a exit,always -F auid=<admin2> -F success=1
...
auditctl -a exit,always -F auid=<adminN> -F success=1
This audits all syscalls of all programs run by the admin. Normally, this is not
what people want or desire. Normally when its asked about how you log
administrative actions, the intended effect is something like the bash history
file. They want to know just what the admin did. Unfortunately, this can be
easily tricked. The admin can open wish or a python shell and just start typing
commands. This does not get recorded in a bash history. So, what you have to do
is record the keystrokes.
A lot of times these security requirements come from places where they run both
windows and linux. So, it sounds innocent. But think about windows. There are
only so many apps and its not like the OS depends on shell scripting. So, what
sounds like an easy to do requirement in windows becomes impossible in linux.
You have so many execve's with normal shell scripts that you get way more data
than you want if you audit on execve.
So, the basic answer is that to weed this down to just the good stuff, you need
to do the keystroke logging or if everything is defined in sudo commands, then
sudo will take care of this for you.
or if by administrators you mean actions run as root (eg, with sudo
or
su), you can do something like
auditctl -a exit,always -F auid=!0 -F euid=0 -F success=1
Again a mountain of data is not good for people. I think there is a clarification
to NISPOM that says too much data is just as bad as not enough data. Making
searching hard to find what you are after is tatamount to not recording it
becuase you can't find it later.
-Steve
4746
days inactive
4746
days old
linux-audit@lists.linux-audit.osci.io
3 comments
3 participants
participants (3)
-
Jender, Raymond [USA] -
Peter Moody -
Steve Grubb