Re: Auditing TCP connections
On Tuesday 08 December 2009 11:21:14 pm Data Lineage wrote:
Is my understanding correct that the Linux Audit framework currently
only logs the remote endpoint of TCP connections?
It records what is passed to the connect syscall or what accept is seeing.
That is, when a connect() call occurs, only the remote IP and port
are
logged, not the local ones?
That is probably correct. I don't recall seeing duplicate network records
If so, would it be possible to add the local end point into the
audit
trail?
I'm pretty sure it could be patched to provide that if its not. I think we
might want a new record type or some way of distinguishing which record is
local and remote.
I have been reading through the new OSPP from NIAP and it calls out for
selective audit based on network address, too. So, it would kind of fit with
what will be required going forward.
So...were you planning to send a patch or is this a request for us to write
one?
-Steve