- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
Anyone,
Does anyone know where I can find documentation on how to configure auditd?
Any help would be appreciated, I need auditd to log the following events:
1) Failed attempts to access files and programs.
2) Users attempts to deleted files and programs.
3) All administrative actions.
4) All security actions.
5) Successful and unsuccessful use of privileged commands.
6) Application and session initiation.
7) All uses of the chown command.
I know these sound kind of vage, but if anyone if familiar with DISA
they should know what I am talking about. Initially we were using LaUS
under RHEL3, but with RHEL4, we are dead in the water.
Again any help would be really appreciated, Javier Godinez
On Monday 02 May 2005 15:47, Javier Godinez wrote:
Does anyone know where I can find documentation on how to configure
auditd?
The only documentation that exists right now is in the auditd package. Try
using the auditd.conf & auditctl man pages.
Any help would be appreciated, I need auditd to log the following
events:
If you have a kernel with the right patches most of these should work. We are
still looking at the filesystem auditing pieces.
they should know what I am talking about. Initially we were using
LaUS
under RHEL3, but with RHEL4, we are dead in the water.
The audit system for RHEL4 is not delivered yet. It takes both kernel patches
and patches to several user space packages. Its all being worked on.
-Steve Grubb
Thanks Steve,
So what syscalls are currently suppoted under auditd version 6.5 which
is what I am using under RHEL4, I had to upgrade some RPMS.
Does anyone know if this is correct, I need to log all uses of the
chown command:
In the /etc/audit.rules I have
-a entry,always -S lchown
-a entry,always -S fchown
-a entry,always -S chown
-a entry,always -S lchown32
-a entry,always -S fchown32
-a entry,always -S chown32
But this does not seem to be working, is chown not inplemented yet?
Thanks a lot, Javier Godinez
On 5/2/05, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Monday 02 May 2005 15:47, Javier Godinez wrote:
> Does anyone know where I can find documentation on how to configure auditd?
The only documentation that exists right now is in the auditd package. Try
using the auditd.conf & auditctl man pages.
> Any help would be appreciated, I need auditd to log the following events:
If you have a kernel with the right patches most of these should work. We are
still looking at the filesystem auditing pieces.
> they should know what I am talking about. Initially we were using LaUS
> under RHEL3, but with RHEL4, we are dead in the water.
The audit system for RHEL4 is not delivered yet. It takes both kernel patches
and patches to several user space packages. Its all being worked on.
-Steve Grubb
7172
days inactive
7173
days old
linux-audit@lists.linux-audit.osci.io
2 comments
2 participants
tags (0)
participants (2)
-
Javier Godinez -
Steve Grubb