Re: audit review question
On Wednesday, April 27, 2016 09:10:39 PM Warron S French wrote:
I have a scenario that I need a little help understanding how to
work
through in an isolated environment of 1 server and 6 workstations (7
machines). The 7 machines are all running CentOS-6.7 and selinux =
disabled.
All 6 workstations are configured through rsyslog.conf to send audit data to
the server, and I have (but apparently not successfully configured general
system messages to also report back to the same server). I am using the
conventional filesystems for each, but the directory structure below is
different.
Rsyslog will likely mangle the audit lines such that its no longer in the
native audit format. I don't know if its headers can be stripped as it writes
to disk.
For audit, I use, /var/log/audit/2016/04/27/wk{1..6}_audit.log
the
directory per day and per month and per year are auto created
(miraculously). For system messages, and I know this isn't the forum to get
help on this so I will only list the directory is -
/var/log/2016/04/27/wk{1..6}_syslog.log.
Now that I am doing this, and successfully, I want to test that the security
auditors will be able to do their job properly, as well as I am trying to
comply with some security constraint that requires me to centralize the
logdata into a single server (hence the major driver for all of this).
I know that there is the aureport and ausearch command, but I am not sure
that I am able to figure out the correct command-line structure to test
that audit-data is getting into the appropriate file, on each day of the
year, on a per serverName basis.
If a real-world situation occurred that the Security Auditors were asking to
find out how many machines did userX attempt to log into, what would be the
appropriate command for the example audit directory I listed above
(/var/log/audit/2016/04/27/wk{1..6}_audit.log), because I am not sure I am
running the command with the appropriate switches to scan the files
properly?
I used:
* aureport -if /var/log/audit/2016/04/27/ and it didn't like the
input,
Probably due to the header it inserts to each record. But this is how you
should do it.
* aureport -if /var/log/audit/2016/04/27/* and it didn't
like the
input, am I using the command improperly?
You shouldn't need the '*'. If the passed option is a dir, then it
automatically looks for more files. But note that the native rotation is
audit.log <- newest
audit.log.1
audit.log.2
audit.log.3 <- oldest
rsyslog would also have to use this scheme. I have never investigated if it
does. That does not means that a wrapper script couldn't be made to walk the
files in rsyslog's order and send them to aureport via stdin. You could
probably even add a sed command to strip the rsyslog headers from each record.
Not the best answer, but once it hits rsyslog, it can change the record in
ways that unknown to me.
-Steve