Re: audit log's server

Hello, On Thursday, October 4, 2018 10:14:17 AM EDT Levin Stanislav wrote: > I try to use auditd as a server to gather logs from remote clients. > > 1) My conditions: > > /rpm -q audit// > //audit-2.8.4/ > > /uname -r// > //4.9.124/ > > /ipv6 is disable/ OK. Out of curiosity, what did you do to disable it?

> 2) Problem's symptom: > > after every reboot of server machine i have > > /from journalctl:/ > > /auditd[765]: Cannot create tcp listener socket I added a commit just now to at least say what address family this is.

> systemd[1]: auditd.service: Control process exited, code=exited status=1 > auditd[764]: Cannot daemonize (Success) > systemd[1]: auditd.service: Failed with result 'exit-code'. > auditd[764]: The audit daemon is exiting. > systemd[1]: Failed to start Security Auditing Service./ > > //ss -lntp -o ' sport = 60 '// > > ////State Recv-Q Send-Q Local > Address:Port Peer Address:Port// > > Later, on system boot, the service can be started manually without error. > > 3) Workarounds: > > a) systemd > > The header of auditd.service tells: > > ## If auditd.conf has tcp_listen_port enabled, copy this file to > ## /etc/systemd/system/auditd.service and add network-online.target > ## to the next line so it waits for the network to start before launching. > > But this leads to circular dependencies in systemd, because auditd says: > "Before=sysinit.target", and network-online.target has not direct > "After=sysinit.target". > > Systemd just skips auditd from boot in this case. This note was changed in git about 2 months ago. https://github.com/linux-audit/audit-userspace/blob/master/init.d/ auditd.service ## If auditd is sending or recieving remote logging, copy this file to ## /etc/systemd/system/auditd.service and comment out the first After and ## uncomment the second so that network-online.target is part of After. ## then comment the first Before and uncomment the second Before to remove ## sysinit.target from "Before". After=local-fs.target systemd-tmpfiles-setup.service ##After=network-online.target local-fs.target systemd-tmpfiles-setup.service Before=sysinit.target shutdown.target ##Before=shutdown.target

> Of course, i can remove auditd's dep on sysinit.target, this breaks a loop. > > > b) ipv4 and ipv6 > > I've added some debug messages into auditd to see what happens. > > Actually ipv6 module is disabled, but in this moment 'getaddrinfo' > within 'auditd_tcp_listen_init' returns both structures - AF_INET and > AF_INET6. It's not supposed to do that based on the discussion of AI_ADDRCONFIG in the getaddrinfo man page.

> While auditd attempts to create AF_INET6 socket (skipping AF_INET) there > is an error message: "/Cannot create tcp listener socket/", errno > /EAFNOSUPPORT./ > > No chances to start./ > / > > > After system boot there is AF_INET only. OK. So, then that seems to indicate that the system starts with IPv6 and then disables it later. Does booting using the new systemd instructions help? Thanks, -Steve

> I have attached the patch if one needs. > > Could somebody suggest a proper solution to my problem? > > Thank you in advance!