Looking at Redhat's website, it seems that they have an audit-1.2.9-1.el5.x86_64.rpm available for download. It's currently listed as beta and it looks like they're rolling it out with EL5, but right now it is listed as a package for EL4. Is that a possibility? -Dan -----Original Message----- From: Steve Grubb [mailto:sgrubb@redhat.com] Sent: Monday, December 11, 2006 1:20 PM To: linux-audit(a)redhat.com Cc: Thomas, Daniel J.; Wieprecht, Karen M. Subject: Re: Linux-audit Digest, Vol 27, Issue 2 On Monday 11 December 2006 12:15, Thomas, Daniel J. wrote: That is the latest for RHEL4. There is a 1.0.15 in the pipeline that backports many features from 1.2.9. There are differences in the RHEL4 kernel and the current 2.6.19 kernel regarding audit that causes them to be incompatible in several ways. 1.3.1 is commandline compatible with 1.0.14. However, you need to be using a 2.6.19 kernel for it. -Steve

versions of audit, but don't really say why...so what's up? Steve, I'm working with Dan Thomas, and maybe I can give you the big picture on where we stand. Bear with me, we have been Googling, rtfm'ing, etc. etc. etc., but are still having trouble getting pointed to good sources for some of what we are trying to understand, so here's some of what we've been learning (maybe you can fill in some gaps we've been unable to fill?): --- A colleague who uses SuSE made some recommendations about setting up auditing to collect file access failures (caused by permissions problems, etc). Not sure his settings should work on RHEL4, but here's what he recommended, and the issues we found when trying to use them: 1. Audit Version Differences ------------------------------- - Our SuSE colleague is using the audit 1.2.3 (because his SuSE kernel-headers and glibc kern-headers aren't new enough to allow him to use a newer audit package - Our RHEL4 system had audit 1.0.14 on it when I was testing before I went to class last week, and that could explain why things behave differently for me than for him ... I'm finding it difficult to locate documentation explaining how similar or different the two are ... The email you sent Dan sounds like things get tested in the development path and then get back ported to RHEL4, so it sounds like version numbers are not necessarily a good indicator of how similar or different the two might be. If that is correct, then where might I find more on these differences? 2. Configuration recommendations: --------------------------------- Here are my colleague's SuSE audit configurations which I tested on RHEL4 with audit 1.0.14: /etc/audit.rules -a exit,always -S all -F exit=-13 (supposed to catch all failed file accesses) /etc/sysconfig/auditd AUDITD_DISABLE_CONTEXTS="no" (supposed to allow system to do syscall logging so that the above audit.rules setting will work) I do know that -13 events get generated when a regular user tries to mess around with files they do not have privs to access, but I couldn't get my audit daemon to capture any of the -13 events with these settings. 3. Audit data differences on directory watches .vs. file watches : ------------------------------------------------------------------ Since I couldn't get the syscall settings to work, I tested the following configurations independently: /etc/audit.rules a. -w /etc/ -p w b. -w /etc/nsswitch.conf Then I attempted to do a number of things to /etc/nsswitch.conf as a regular user to see if the auditing would detect it: action attempted general /etc watch specific /etc/nsswitch.conf ---------------- ------------------ --------------------------- touch NO yes rm yes yes mv yes yes chown NO yes chgrp NO yes vi yes yes nedit (no because nedit saw that the file did not have write permission, and opened it read only with no errors) chmod 777 NO yes append (via >>) NO yes replace (via > ) NO yes The generic directory watch isn't going to cut it for us because it misses a lot of things that should get logged, but it's not practical to set a specific watch on every file someone might try to mess with where they don't have permission... When I had the specific watch on /etc/nsswitch.conf, I saw that all of the actions I tested generated a -13 exit code, so I would think that my colleague's audit rule would work for us as a generic way to watch for ANY file permission failures rather than having to set a watch on every single file we want to monitor, so that's what we were working towards. We thought that our attempt to collect the -13 exit codes might be failing because of the difference in our audit version from one where we know this works, and that's why we were trying to test a later version of audit. Perhaps you can lend some insight on some of this? ----------------------- Questions and confusion ----------------------- 1. Should we be able to collect -13 exit codes in RHEL4's audit 1.0.14 ? If so, is there something else we might have to do to get this working other than the two configuration changes mentioned in Item 2 above? If not, what might you recommend? We have looked at the /usr/share/doc/audit-1.0.14/capp.rules for guidance, but it doesn't help much when trying to determine how to catch file access failures without specific watched on every file of interest (which I think isn't very practical or reliable). 2. Where might I find out more about the configurable options accepted by /etc/sysconfig/auditd? A google search on "/etc/sysconfig/auditd" came up with a lot package information, but not much about its configuration options, and a search on "AUDITD_DISABLE_CONTEXTS" didn't really get me anywhere ... 3. If a linux kernel is a Linux kernel, then what's the scoop on using Fedora Core (or some other flavor) src rpms on RHEL4 if we can't find a RHEL4-specific src rpm for something we need (like a newer kernel-headers)? Is this a typical practice, or possible but unsupported, or completely not recommended? 4. If there is no src rpm for something we need, but there IS a tar.gz, what's involved in building and installing that package, and are there precautions we need to take, particularly when it involves things like glibc-kernheaders or kernel-headers? Thanks for any pointers or light you can shed on any of this. Karen Wieprecht

Steve, thank you very much for your in depth reply to my very lengthy email.. I have about a gazillion years of sysadmin experience on various Unix platforms (Solaris, HP-UX, Mac OSX, Irix), but linux is very different with respect to tracking kernel revisions for various flavors, figuring out what can be used with what, etc. It's quite confusing, and even though I just got back from a week long class (a SuSE class specifically for SGI Altix systems), there are many questions left unanswered. Your help is **most **appreciated. THanks again, Karen Wieprecht

On Tuesday 12 December 2006 17:08, Wieprecht, Karen M. wrote: Some one published a perl based viewer to this mail list earlier this year. I forget when. The aureport program was supposed to fill the immediate role of breaking the data down into something a little more useful. My intentions are to use that as the basis of a GUI based tool. The work is going slow and I'm at the poiint of writing the parser library. Aside from that perl based viewer and aureport, nothing I know of. It would be helpful to me to know what your use cases/requirements are. Thanks, -Steve

On Wednesday 13 December 2006 11:36, Jonathan Abbey wrote: It wasn't Leigh, it was someone else about a month later. Hopefully that is "or higher". RHEL4 did not have the dispatcher interface in it right away. I wanted to study the problem a little more since the API might change based on real use scenarios. I think we've gotten enough runtime now to see how its working out and I've backported it - which became the 1.0.15 release. I have another set of updates to make and I'll release a 1.0.16 version and that should make it to the U5 release. So, that would be the first RHEL4 version that could support such a setup. -Steve

are. I guess the main thing we want is to make the audit data easier to understand when we are reviewing it, and I'd rather not have to issue multiple ausearch commands per machine times n systems to get an overview of possible wrongdoing on the machine ... Certainly I can use those tools to investigate further if I see something suspicious. I'll have to see if I can find the script you mentioned online somewhere and see if it's close to what I want. If not, here's a feel for what we'd be interested in as a bare minimum, and certainly any improvements would be even better. Here is a sample of what I did with some test audit output on Solaris 10. The perl scripts that I have written for Irix, Solaris, and Mac OSX aren't super savvy, but they pull the data into a key value hash table so I can reformat it into a more english-like format (and I throw out stuff my site doesn't care about like file access failures that are caused by "file not found" rather than permission problems). Except for irix (where I shoot converted stuff to a central host via the syslog facility), my scripts also manage the audit data to keep it to a manageable size, move it to a central place where I can keep straight which data has or has not already been reviewed, and let me review audit logs on multiple machines all at once. I wrote these scripts for Solaris 8 before I knew about snare, then I ported them to mac OSX (again, snare wasn't available on that platform), and then ported them again to Solaris 10 before a snare version was available there. I use my scripts in conjuntion with snare on Irix to make the audit data easier to read. Here is a samplae of the converted solaris 10 output: ------------------------------------------------------------------- (invalid user) FAILED to telnet into oldpatton from oldzumwalt: No account present for user on 2005-09-28 15:41:29.608 -04:00 rick FAILED to ftp into oldpatton from oldzumwalt: bad password on 2005-09-28 15:42:00.448 -04:00 rick FAILED to ftp into oldpatton from oldzumwalt: misc failure on 2005-09-28 15:42:00.451 -04:00 root successful rlogin into oldpatton from oldzumwalt on 2005-09-28 15:42:06.297 -04:00 root logged out of oldpatton on 2005-09-28 15:42:15.065 -04:00 karen successful rlogin into oldpatton from oldzumwalt on 2005-09-28 15:42:25.127 -04:00 karen as root on oldpatton ran setaudit_addr(2) on 2005-09-28 15:42:30.905 -04:00 **** karen as root on oldpatton ran su root on 2005-09-28 15:42:30.908 -04:00 karen as root on oldpatton ran setaudit_addr(2) on 2005-09-28 15:42:35.190 -04:00 **** karen as root on oldpatton ran su rick on 2005-09-28 15:42:35.193 -04:00 karen as rick on oldpatton FAILED to modify time on /etc/shadow: Permission denied on 2005-09-28 15:42:40.262 -04:00 karen as rick on oldpatton FAILED to remove /etc/shadow: Permission denied on 2005-09-28 15:42:46.506 -04:00 karen as root on oldpatton FAILED to su thomas: bad username on 2005-09-28 15:44:05.870 -04:00 karen as root on oldpatton FAILED to su dan: bad auth. on 2005-09-28 15:44:15.811 -04:00 (invalid user) FAILED to ftp into oldpatton from oldpatton: bad password on 2005-09-28 15:45:03.703 -04:00 (invalid user) FAILED to ftp into oldpatton from oldpatton: misc failure on 2005-09-28 15:45:03.705 -04:00 rick FAILED to ftp into oldpatton from oldpatton: bad password on 2005-09-28 15:45:15.391 -04:00 rick FAILED to ftp into oldpatton from oldpatton: misc failure on 2005-09-28 15:45:15.394 -04:00 dan FAILED to telnet into oldpatton from oldpatton: Authentication failed on 2005-09-28 15:45:26.661 -04:00 karen on oldpatton FAILED to open /etc/security/policy.conf: Permission denied on 2005-09-28 15:45:38.063 -04:00 karen on oldpatton FAILED to rmdir /home/karen/.sunw/pkcs11_softtoken: File exists on 2005-09-28 15:45:38.112 -04:00 karen on oldpatton FAILED to open /dev/devices/pseudo/random@0:urandom: Permission denied on 2005-09-28 15:45:38.148 -04:00 (invalid user) FAILED to ssh into oldpatton from oldpatton: Authentication failed on 2005-09-28 15:45:48.094 -04:00 karen on oldpatton FAILED to mkdir /home/karen/.sunw/pkcs11_softtoken: File exists on 2005-09-28 15:46:07.587 -04:00 karen on oldpatton FAILED to open /dev/devices/pseudo/random@0:urandom: Permission denied on 2005-09-28 15:46:07.602 -04:00 (invalid user) FAILED to ssh into oldpatton from oldpatton: Authentication failed on 2005-09-28 15:46:13.153 -04:00 karen on oldpatton FAILED to modify time on /var/audit: Permission denied on 2005-09-28 15:46:22.179 -04:00 karen on oldpatton FAILED to modify time on /etc/shadow: Permission denied on 2005-09-28 15:46:29.514 -04:00 karen on oldpatton FAILED to open /etc/shadow: Permission denied on 2005-09-28 15:46:47.469 -04:00 karen on oldpatton FAILED to create /etc/shadow: Permission denied on 2005-09-28 15:47:10.423 -04:00 karen logged out of oldpatton on 2005-09-28 15:47:32.486 -04:00 ---------------------------------------------------------------- I realize that the tabs/spaces don't line up, but I sort the output, and even though the entries are no longer in chronological order, similar records are grouped, the sentences read like english instead of scrambled garbage, and it's pretty easy to visually scan through the data. Savvy programmers might do something better than this, but it's simple and it beats the pants of off looking at the raw Solaris audit data: ---------------------------------------------------------------- # << --- *snip* ---->> header,95,2,getaudit_addr(2),,oldpatton,2005-09-28 15:42:35.191 -04:00,subject,karen,root,root,root,root,10377,3015119284,242 513 oldzumwalt,use of privilege,successful use of priv,sys_audit,return,success,0 header,94,2,su,,oldpatton,2005-09-28 15:42:35.193 -04:00,subject,karen,root,root,root,root,10377,3015119284,242 513 oldzumwalt,text,success for user rick,return,success,0 header,137,2,utimes(2),fe,oldpatton,2005-09-28 15:42:40.262 -04:00,path,/etc/shadow,attribute,100400,root,sys,32,50382,0,subject,kar en,rick,users,rick,users,10381,3015119284,242 513 oldzumwalt,use of privilege,failed use of priv,ALL,return,failure: Permission denied,-1 header,137,2,unlink(2),fe,oldpatton,2005-09-28 15:42:46.506 -04:00,path,/etc/shadow,attribute,100400,root,sys,32,50382,0,subject,kar en,rick,users,rick,users,10382,3015119284,242 513 oldzumwalt,use of privilege,failed use of priv,ALL,return,failure: Permission denied,-1 header,166,2,symlink(2),fe,oldpatton,2005-09-28 15:43:39.253 -04:00,path,/var/audit/fileshouldntbeallowedindirwhereuserhasnopermissio n,subject,karen,rick,users,rick,users,10383,3015119284,242 513 oldzumwalt,use of privilege,failed use of priv,file_dac_search,return,failure: Permission denied,-1 header,214,2,link(2),fe,oldpatton,2005-09-28 15:43:55.986 -04:00,path,/etc/passwd,attribute,100644,root,sys,32,50381,0,path,/var/a udit/fileshouldntbeallowedindirwhereuserhasnopermission,subject,karen,ri ck,users,rick,users,10384,3015119284,242 513 oldzumwalt,use of privilege,failed use of priv,file_dac_search,return,failure: Permission denied,-1 header,81,2,auditon(2) - get audit state,,oldpatton,2005-09-28 15:44:05.859 -04:00,subject,karen,root,users,rick,users,10385,3015119284,242 513 oldzumwalt,return,success,0 header,95,2,getaudit_addr(2),,oldpatton,2005-09-28 15:44:05.866 -04:00,subject,karen,root,users,rick,users,10385,3015119284,242 513 oldzumwalt,use of privilege,successful use of priv,sys_audit,return,success,0 header,95,2,getaudit_addr(2),,oldpatton,2005-09-28 15:44:05.866 -04:00,subject,karen,root,users,rick,users,10385,3015119284,242 513 oldzumwalt,use of privilege,successful use of priv,sys_audit,return,success,0 header,95,2,getaudit_addr(2),,oldpatton,2005-09-28 15:44:05.868 -04:00,subject,karen,root,users,rick,users,10385,3015119284,242 513 oldzumwalt,use of privilege,successful use of priv,sys_audit,return,success,0 # << --- *snip* ---->> Thanks, Karen Wieprecht -Steve