November 2009 - Linux-audit - Linux-Audit List Archives

by LC Bruzenak

I know I can go look at the code, however I figured I'd ask here first about the limits on the user message in both audit_log_user_message and ausearch. With audit_log_user_message the maximum length allowed appears to be around MAX_AUDIT_MESSAGE_LENGTH-100. I think it may depend on the executable name length (and other stuff auto-pushed into the string) which is why I say "around". Even when I get a successful return value (from audit_log_user_message), I don't get my string back out in "ausearch" unless it is WAY smaller - ~1K or less I think. Any ideas/thoughts? This is the latest (1.7.11-2) audit package. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

12 years, 2 months

5
17
0 / 0

AUDIT_SIGNAL_INFO

by Matthew Booth

Under what circumstances will the RHEL 4 kernel generate a message of type AUDIT_SIGNAL_INFO? My understanding is that it should be sent when a process sends a signal to the audit daemon, however I have not observed that. Any ideas? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

13 years, 6 months

3
4
0 / 0

Near Term Audit Road Map

by Steve Grubb

Hi, With the proposals sent to the list, I wanted to talk about how this might play out code-wise. With regard to the current code base, I am working on a 1.8 release. This would represent finishing the remote logging app and nothing more. The 1.8 series would become just an update series just like the 1.0.x series did. In parallel with finishing remote logging, I would release a 2.0 version. Patches applied to 1.8 would also be applied to 2.0. A 2.1 release would signify the completion of remote logging that branch. I would recommend this branch for all distributions pulling new code in. The 2.0 branch will also have a couple more changes. I want to split up the audit source code a little bit. I want to drop the system-config-audit code and let it become standalone package updated and distributed separately. I also want to drop all audispd-plugins in the 2.0 branch and have them released separately. They cause unnecessary build dependencies for the audit package. During the work for a 2.2 release, I would also like to pull the audispd program inside auditd. In the past, I tried to keep auditd lean and single purpose, but with adding remote logging and kerberos support, we already have something that is hard to analyze. So, to improve performance and decrease system load, the audit daemon will also do event dispatching. Would this proposal impact anyone in a Bad Way? Thanks, -Steve

13 years, 6 months

4
11
0 / 0

ausearch

by Pittigher, Raymond - CS

I see that the -w or --word switch was added to the ausearch but how it it used? The man pages claim: String based matches must match the whole word. But I have been trying ausearch -w failed and variation of that but only get the message ausearch -if audit.log.3 -w failed failed is an unsupported option This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

15 years, 1 month

3
2
0 / 0

auditing activity where uid==0

by Rich Whitcroft

Hi, Here's my current rule, which is working, but is producing a lot of extra log that I'd like to suppress: -a entry,always -S execve -F euid=0 I'm wondering if there's a way to limit this to only audit events that happen from a real tty, e.g. a human user. I'm getting lots of extraneous chatter from sshd, automount, and cron, all of which are from tty=(none), but I'm not sure it's possible to filter on tty... Thanks

16 years

3
3
0 / 0

Audit Log not capturing access to security related files

by Starr-Renee Corbin

Hello, I am required (by NISPOM) to audit access to security related files. I am essentially using the nispom audit.rules provided by rhel5 to accomplish this. However, some of my systems are capturing access to /etc/shadow and some of my systems are not (when looking in /var/log/audit/audit.log. Worried that I might have differing audit.rules files between the systems I have even copied the audit.rules file from systems that were auditing right to systems that were not. But this has not resolved the auditing problem. HELP! Thank you! Starr

16 years

3
2
0 / 0

check_second_connection stopping my recovery?

by LC Bruzenak

It appears to me as though the new connection code in auditd-listen.c is stopping my recovery actions. My aggregator is getting a constant stream of: op=dup addr=192.168.10.10:43546 port=43546 res=no I was going back through the events on disk, scooping them up and sending them to the aggregation machine as Steve suggested a long while back (using an ausearch then piping the results to audisp-remote). So it appears to me that this is now prohibited. Was this intentional? Thx, LCB. -- LC (Lenny) Bruzenak

16 years

2
2
0 / 0

Fwd: Reactive rules proposal

by Miloslav Trmac

From: "Juraj Hlista" <juro.fit(a)gmail.com> I'm working on implementation of reactive rules into the audit. I've come up with a new type of rule (AUDIT_ALWAYS_REACT) which is almost the same as AUDIT_ALWAYS. The only difference is that the kernel generates one more message of type REACT_RULE when this rule is used. For instance, let's suppose that the reactive rule was added into the rule set with auditctl: auditctl -a exit,react -F path=/tmp/file -F perm=r then "cat /tmp/file" generates the following audit message: type=REACT_RULE msg=audit(1259164875.572:4): type=SYSCALL msg=audit(1259164875.572:4): arch=c000003e syscall=2 success=yes exit=3 a0=7fffdf4389cb a1=0 a2=2 a3=0 items=1 ppid=1148 pid=1165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0fsgid=0 tty=pts1 ses=4294967295 comm="cat" exe="/bin/cat" key=(null) type=CWD msg=audit(1259164875.572:4): cwd="/root" type=PATH msg=audit(1259164875.572:4): item=0 name="/tmp/file" inode=27872 dev=03:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 Also, I'm working on a plugin which watches for the messages of type REACT_RULE and makes decisions accordingly. This plugin has a configuration file which could look like this: variable = 0; "action1" { exec "program1" add/delete rule if (variable == 0) { exec "program2" } } The problem is that the plugin needs to recognize what reactive rules have been reacted to. The kernel just generates messages without any identifier. In order to solve it, auditctl has to add an identifier to the reactive rule somehow, for example, using -k parameter: auditctl -a exit,react -k "action1" -F path=/tmp/file -F perm=r Another solution would be creating a new parameter, for example, -k_react. Any suggestions? ----------

16 years

1
0
0 / 0

audit-1.7.16 released

by Steve Grubb

Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - If audisp-remote plugin has a queue at exit, use non-zero exit code - In auditd, tell libev to stop processing a connection when idle timeout - In auditd, tell libev to stop processing a connection when shutting down This release fixes a bug introduced in the 1.7.15 release. The main problem was that the idle timeout was not telling libev to stop processing the associated socket when it closed an idle connection. Subsequent reconnects would go into an error state and libev would immediately close the new connection. This update fixes that problem. I also applied a patch from trunk that checks the queue size on exit of audisp-remote to decide if it was successful or not. Please let me know if you run across any problems with this release. -Steve

16 years

2
8
0 / 0

audisp-remote options

by Nicholas Nachefski

I worked through a situation awhile back and wanted to send a quick post to the list describing how i solved it in case anyone else may be needing help. The issue i cam across was that several of my customer boxes stopped logging to my consolidated audit server via audisp-remote. I received messages in the local /var/log/messages files for these servers stating that the network connection to my log server had been broken and that audisp-remote was terminating. Obviously, i need audisp-remote to not terminate when it cant find the log server and to keep attempting to re-connect(while spooling events locally, see 'q_depth'). The corrective action i took that resolved my issue was to adjust two parameters in the /etc/audisp/audisp-remote.conf config file: I modified the following parameters: network_failure_action = stop remote_ending_action = suspend and changed them to: network_failure_action = ignore remote_ending_action = reconnect and now all of my customer boxes are reporting without stoppage, even when the network or log server is temporarily unavailable. I imagine the local audit buffer will fill up on the client side though if your network or log server is unavailable for any extended period of time. Just though i would share in case anyone needs help with this. -Nick Nachefski

16 years

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit November 2009