Re: Security audit rules
On Sunday, November 24, 2019 1:44:03 AM EST Kadirvadivelu, Vezhavendan 1.
(EXT - IN/Chennai) wrote:
That's clear on the rules. Thanks for that, but my question is
where should
I place the file called 'audit.rules'. It should be under '/etc/audit'
or
'/etc/audit/rules.d' or in both places.
Nowhere. audit.rules is built by augenrules using the sorting method
described in the man page for it. Again, there is a README-rules file that
explains how this works. If you have specific things that you would like to
add, then make a file for it and place it in /etc/audit/rules.d where it will
get combined with other rule files. README-rules gives suggestions about how
to name the file for predictable inclusion.
-Steve
-----Original Message-----
From: Steve Grubb <sgrubb(a)redhat.com>
Sent: Friday, November 22, 2019 10:39 PM
To: linux-audit(a)redhat.com
Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
<vezhavendan.1.kadirvadivelu.ext(a)nokia.com>; Richard Guy Briggs
<rgb(a)redhat.com> Subject: Re: Security audit rules
On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1.
(EXT - IN/Chennai) wrote:
> I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)).
This distribution wants rules placed in /etc/audit/rules.d/ The audit
package should have a file named README-rules that explains what is
expected.
-Steve
> -----Original Message-----
> From: Richard Guy Briggs <rgb(a)redhat.com>
> Sent: Wednesday, November 20, 2019 4:03 AM
> To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
> <vezhavendan.1.kadirvadivelu.ext(a)nokia.com> Cc: linux-audit(a)redhat.com
> Subject: Re: Security audit rules
>
> On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
wrote:
> > Hi,
> >
> > In one of the VM I find audit.rules defined under /etc/audit as well
> > as /etc/audit/rules.d.
> >
> > What is the significance as well as difference between the files
> > found in
> > 2 places.
>
> You haven't said what distro you are using. In more recent distros,
> the rules in rules.d are used by augenrules to populate audit.rules,
> overwriting them.
>
> > Also please let me know what is the correct location where
> > audit.rules need to be places.
>
> Depends on your distro.
>
> > Vezhavendan K
>
> - RGB
>
> --
> Richard Guy Briggs <rgb(a)redhat.com>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote,
> Ottawa, Red Hat Canada IRC: rgb, SunRaycer
> Voice: +1.647.777.2635, Internal: (81) 32635
>
>
> --
> Linux-audit mailing list
> Linux-audit(a)redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit