Re: audit-tools and SUDO
On Tuesday, May 10, 2016 01:44:50 PM Warron S French wrote:
> > I have two problems though; and they seem somewhat minor:
> >
> > 1. The audit events being captured don’t seem to be tied to any
> > given node (so that I can perform ausearch --node hostName, or
> > aureport), that’s the first issue.
>
>
> What have you set the configuration parameter 'name_format'
> in /etc/audit/auditd.conf to?
>
> One assumes you may want to set
> name_format = fqd
> or
> name_format = hostname
>
> After the change on each host, don't forget to reload the
> configuration with either a sighup on the auditd process or just restart
> the service.
On the lab-clients ends:
In, and ONLY IN, my /etc/audisp/audispd.conf file have I set
name_format=hostname, where hostname is a literal string of 'hostname' not
THE hostname;
This is correct. Did you set remote_server in /etc/audisp/audisp-remote.conf?
there is no name_format reference in any other file on my
lab-client machines under the directory /etc/audisp/ anywhere. Also on my
lab-client machines in the /etc/audit/auditd.conf file the name_format
variable is set to NONE.
On the lab-server end:
In the only file that I modified, /etc/audit/auditd.conf, the only variables
that I altered were:
tcp_listen_port = 60
tcp_client_ports = 60
use_libwrap = no (because I am using iptables)
You would want to set name_format. This way the local events on the
aggregating server have the same format.
The lab works as expected, but my production environment does not.
%-/
I would start by checking that events are coming out of the remote systems.
You can use tcpdump port 60 on the clients. After confirming that, do the same
on the server to see if events are getting there. Then look in syslog for
anything that might give a clue. And then you can also tail -f
/var/log/audit/audit.log to see if things are getting written to disk.
-Steve