12:35 p.m.
Hi,
I'm getting closer to releasing the next version of the audit daemon. I'm
wanting to include a file that has sample auditctl rules demonstrating how to
do various things. I'm open to ideas. What common tasks should be included?
Note the file will be installed in the docs directory rather than being the
default ruleset.
-Steve Grubb
3:26 p.m.
On Thu, 10 Feb 2005 13:35:53 EST, Steve Grubb said:
I'm getting closer to releasing the next version of the audit
daemon. I'm
wanting to include a file that has sample auditctl rules demonstrating how to
do various things. I'm open to ideas. What common tasks should be included?
Note the file will be installed in the docs directory rather than being the
default ruleset.
I can *guarantee* that something you will eventually be asked is:
"What auditctl rules do I need to split things into classes equivalent to
the Solaris/AIX/Irix (pick one or more) audit classes?"
For instance, the current Center for Internet Security benchmark for Solaris recommends:
flags:lo,ad,cc
naflags:lo,ad,ex
(and some tweaking - the 'cc' class is fm+p[cms] minus a few things that tend
to flood the log like fcntl and flock). So somebody is going to ask "How do I
do the same thing on Linux?"....
(Am pressed for time, don't have the Irix pointer handy)
Solaris Reference:
http://www.sun.com/solutions/blueprints/0201/audit_config.pdf
"Auditing in the Solaris 8 Operating Environment," February 2001, by William
Osser and Alex Noordergraaf The use of the Solaris auditing system (SunSHIELD
Basic Security Module or BSM) has never been well understood. This article
presents an auditing configuration optimized for the Solaris 8 environment. The
recommended configuration will audit activity on a system without generating
gigabytes of data every day. In addition, the audit configuration files are
available.
For AIX:
http://www.redbooks.ibm.com/abstracts/SG246396.html?Open
(Especially chapter 2 and appendix A).
3:50 p.m.
--- Valdis.Kletnieks(a)vt.edu wrote:
I can *guarantee* that something you will eventually
be asked is:
You are correct. It won't even take long.
"What auditctl rules do I need to split things into
classes equivalent to
the Solaris/AIX/Irix (pick one or more) audit
classes?"
Chuckle. Irix does not have audit classes.
This is for the simple reason that Solaris
does and the lesson learned is that it is
impossible to find any two people who can
agree on what should be grouped together.
On Irix you have to tell it what events
you want.
(Am pressed for time, don't have the Irix pointer
handy)
http://techpubs.sgi.com/library/tpl/cgi-bin/getdoc.cgi/srch5@audit/0650/b...
Of course, neither system audits on a system
call basis. Events are selected by the policy
enforced. This may confound those who don't
realize that because of this policy perspective
turning on audit for chown() will also enable
audit for chmod().
Chown and chmod are controlled by the
file-system-object-attribute-write policy.
You can (on those U2X systems) monitor
that policy's enforcement in the kernel
but if you want to audit all calls to chmod
you need to watch that policy and filter
out all other system call records.
=====
Casey Schaufler
casey(a)schaufler-ca.com
__________________________________
Do you Yahoo!?
Yahoo! Mail - 250MB free storage. Do more. Manage less.
http://info.mail.yahoo.com/mail_250
6:13 p.m.
On Thu, 10 Feb 2005 13:50:50 PST, Casey Schaufler said:
Chuckle. Irix does not have audit classes.
This is for the simple reason that Solaris
does and the lesson learned is that it is
impossible to find any two people who can
agree on what should be grouped together.
On Irix you have to tell it what events
you want.
As a first cut, probably a list of equivalences (Irix calls the
record Foo, Solaris Bar, AIX Baz - use Quux on Linux) would be a big
help...
9:14 a.m.
On Thursday 10 February 2005 16:26, Valdis.Kletnieks(a)vt.edu wrote:
"What auditctl rules do I need to split things into classes
equivalent to
the Solaris/AIX/Irix (pick one or more) audit classes?"
This is going to take a lot of research on my part. I have never used the
audit system of SUN machines. Nor do I want to...too much code to write at
the moment.
It's a good question and maybe someone else that's had experience with that
machine can help sort it out one day.
Thanks,
-Steve Grubb
3:09 p.m.
This is probably something that we can help out with down the track a
little.
At the moment, I'm supporting audit agents on Solaris, AIX, Irix,
Windows, Lotus Notes, and many others (including, of course, linux) - so
coming up with rough 'equivalent capability groups' is likely to be
something that we're likely to do as part of our 'Snare' development
activities.
Leigh.
On Fri, 2005-02-11 at 10:14 -0500, Steve Grubb wrote:
On Thursday 10 February 2005 16:26, Valdis.Kletnieks(a)vt.edu wrote:
> "What auditctl rules do I need to split things into classes equivalent to
> the Solaris/AIX/Irix (pick one or more) audit classes?"
This is going to take a lot of research on my part. I have never used the
audit system of SUN machines. Nor do I want to...too much code to write at
the moment.
It's a good question and maybe someone else that's had experience with that
machine can help sort it out one day.
Thanks,
-Steve Grubb
--
Linux-audit mailing list
Linux-audit(a)redhat.com
http://www.redhat.com/mailman/listinfo/linux-audit
--
Leigh Purdie, Director - InterSect Alliance Pty Ltd
http://www.intersectalliance.com/
9:43 a.m.
On Thu, 10 Feb 2005 16:26:48 -0500, Valdis.Kletnieks(a)vt.edu
<Valdis.Kletnieks(a)vt.edu> wrote:
I can *guarantee* that something you will eventually be asked is:
"What auditctl rules do I need to split things into classes equivalent to
the Solaris/AIX/Irix (pick one or more) audit classes?"
Do you know by chance if this was supported in LAuS? If it was, Steve
can use that as a reference example. I don't remember this feature,
personally. But my experience with LAuS was rather limited.
--
Linux-audit mailing list
Linux-audit(a)redhat.com
http://www.redhat.com/mailman/listinfo/linux-audit
--
- Timothy R. Chavez
11:29 a.m.
On Fri, Feb 11, 2005 at 09:43:53AM -0600, Timothy R. Chavez wrote:
On Thu, 10 Feb 2005 16:26:48 -0500, Valdis.Kletnieks(a)vt.edu
<Valdis.Kletnieks(a)vt.edu> wrote:
> "What auditctl rules do I need to split things into classes equivalent to
> the Solaris/AIX/Irix (pick one or more) audit classes?"
Do you know by chance if this was supported in LAuS? If it was, Steve
can use that as a reference example. I don't remember this feature,
personally. But my experience with LAuS was rather limited.
I'm not aware of any compatibility between LAuS and any other audit
implementation in this respect.
LAuS does have admin-configurable audit tags for syscalls and some other
types of events, but userspace generated messages have the tag hardcoded
in the application.
-Klaus
5:58 p.m.
Steve,
Here are examples of some rules we have been working with:
Adding rules:
auditctl -a exit,never -S mount
auditctl -a entry,always -S access -F a1=4
auditctl -a exit,always -S ipc -F a0=2
Deleting rules:
auditctl -d exit,never -S mount
auditctl -d entry,always -S access -F a1=4
auditctl -d exit,always -S ipc -F a0=2
Examples we would like to have:
Task rules.
Examples using more of the -F fields, including mulltiple -F fields in one rule.
Kris Wilson
Linux Security
(512) 838-0126 T/L:678-0126
krisw(a)us.ibm.com
Steve Grubb
<sgrubb(a)redhat.co
m> To
Sent by: Linux Audit Discussion
linux-audit-bounc <linux-audit(a)redhat.com>
es(a)redhat.com cc
Subject
02/10/2005 12:35 Sample Rules
PM
Please respond to
Linux Audit
Discussion
Hi,
I'm getting closer to releasing the next version of the audit daemon. I'm
wanting to include a file that has sample auditctl rules demonstrating how
to
do various things. I'm open to ideas. What common tasks should be included?
Note the file will be installed in the docs directory rather than being the
default ruleset.
-Steve Grubb
--
Linux-audit mailing list
Linux-audit(a)redhat.com
http://www.redhat.com/mailman/listinfo/linux-audit
7251
days inactive
7254
days old
linux-audit@lists.linux-audit.osci.io
9 comments
7 participants
participants (7)
-
Casey Schaufler -
Klaus Weidner -
Kris Wilson -
Leigh Purdie -
Steve Grubb -
Timothy R. Chavez -
Valdis.Kletnieks＠vt.edu