New List Member: Intro & comments

Hi, I'm primarily an applications developer, though I wear a sys-admin/security-admin hat when necessary. I've done kernel hacking on V-7 and System-3 in the bad old days, but mostly stick in userland now. My current goal is to get some OpenSuse 10.1 systems DSS certified. I've been a RedHat user since about RH4 or 5, but this project decided to standardize on SuSE. My focus for using auditd isn't so much to make a truly secure and well audited system, but to answer the specific DSS/NISPOM Chapter 8 requirements. SuSE supports AppArmor and the auditd security products, but has very little SELinux support. As I read things, AppArmor doesn't support the file audit requirements, but Auditd can meet the DSS requirements. I've updated the standard SuSE 10.1 kernel to 2.6.17.6 and brought in the 3.0 glibc kernel headers. With these hacks, I can get the 1.2.5 auditd package to compile and install. It appears to be working. Auditd 1.2.5 doesn't quite do what I need, but I'm getting close. It has the framework, but it seems to take a little work to get the answers I really want, and to handle the requirements for record maintenance. 1) Auditing and reporting I've copied the SYSCALL rules from the capp.rules sample, and I think that covers what DSS will need audited. (Still checking and confirming that I haven't missed anything obvious.) To get the answers I wanted a bit more easily, I've made a GUI based search tool that lets me specify reports with a bit more precision and build customized reports. It's functional code, but is not pretty, and gets pretty ugly when the data is way outside what I expected. 2) Maintaining records The traditional log-rotate with N logs makes it difficult to keep X days of logs. When the system is busy, I can rotate the logs every 10 minutes. I've put together a small cron job that looks for audit.log.1, filters out some data I know I won't want, and zips it into a file with a name based on the timestamp. My current report generator builds an SQLite database on the fly from the flat ASCII logs. I'm thinking that the next rev of the file rotation code will move the data to an SQLite database instead of gzipped flat files and save that step. I'm using SQLite instead of mySQL or Postgres because it it's fast, mature and robust and doesn't require any database server (or dbadmin) to run it. I put together a small audisp test application to read from stdin and save data in a timestamped file. When I run this, I get nothing but empty reads, and finally an EOF from auditd. I'm expecting to see plain ASCII input. Is this not what is sent to the audisp target? I just tried the sample.c application, compiled it to a.out and put that into the auditd.conf file. When I restart audispd, I see no output in /var/log/messages, and a.out does not show in the process stack. If I just run /tmp/a.out and type something, output appears in /var/log/messages. If any of this is of interest or use, let me know, and I'll make it available to the community. Thanks, Clif -- .... Clif Flynt ... http://www.cflynt.com ... clif(a)cflynt.com ... .. Tcl/Tk: A Developer's Guide (2nd edition) - Morgan Kauffman .. ..13th Annual Tcl/Tk Conference: Oct 9-13, 2006, Chicago, IL .. ............. http://www.tcl.tk/community/tcl2006/ ............