Linux LINUX ENTERPRISE DESKTOP 10 SP1 - User manual

Linux audit allows you to comprehensively log and track any access to les, directories, or resources of your
system and trace system calls. It enables you to monitor your system for application misbehavior or code mal-
functions. By creating a sophisticated set of rules including le watches and system call auditing, you can make
sure that any violation of your security policies is noticed and properly addressed.
To set up Linux audit on your system, proceed as follows:
1. Stop the audit daemon that is running by default with
the rcauditd stop command.
2. Adjust the system conguration for audit and enable
audit.
3. Congure the audit daemon.
4. Determine which system components to audit and set
up audit rules.
5. Start the audit daemon after you have completed the
conguration of the audit system using the rcauditd
start command.
6. Determine which reports to run and congure these
reports.
7. Analyze the audit logs and reports.
8. (Optional) Analyze individual system calls with autrace.
IMPORTANT: Users Entitled to Work
with Audit
The audit tools, conguration les, and logs are
only available to root. This protects audit from
ordinary users of the system. To manipulate any
aspect of audit, you must be logged in as root.
Enabling Audit
Your rst tasks enabling audit are:
•Adjust the PAM conguration to enable audit ID tracking.
• Enable system call auditing in /etc/sysconfig/
auditd.
Audit allows you to consistently track a user's actions from
login right through logout no matter which identities this
user might adopt by using audit IDs that are created upon
login and handed down to any child process of the original
login process. Modify the PAM conguration of several
components (login, sshd, gdm, crond, and atd). Open the
PAM conguration for each application (/etc/pam
.d/application) and add the following line before the
common-session line:
session required pam_loginuid.so
session include common-session
The changes in PAM conguration take effect as soon as
the application is called again, for example, login, sshd, and
the display managers log with an audit ID at the next login.
Because you need system call auditing capabilities even
when you are conguring plain le or directory watches,
enable audit contexts for system calls:
Enabling System Call Auditing for One Session Only
Enable with auditctl -e 1 and disable with au-
ditctl -e 0. These settings are not persistent and do
not survive a reboot.
Linux Audit Quick Start
SUSE Linux Enterprise 10 SP1
NOVELL® QUICK START CARD
1

Enabling System Call Auditing Permanently
Permanently enable audit contexts for system calls by
changing AUDITD_DISABLE_CONTEXTS in /etc/
sysconfig/auditd from yes to no. To permanently
disable audit contexts for system calls, revert this setting
to yes. Restart the audit daemon to apply the new
conguration with rcauditd start.
Conguring Audit
The conguration of the audit daemon is contained in the
/etc/auditd.conf conguration le. The default settings
as shipped with SUSE Linux Enterprise should be sufcient
for most setups.
log_file = /var/log/audit/audit.log
log_format = RAW
priority_boost = 3
flush = INCREMENTAL
freq = 20
num_logs = 4
dispatcher = /usr/sbin/audispd
disp_qos = lossy
max_log_file = 5
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
Most of the settings in this le concern the audit log les
and how the logging is done. The most important settings
all concern the actions the daemon should take when en-
countering certain critical conditions or errors (system low
on disk space, system out of disk space, or disk error) and
when to warn the administrator about these conditions.
These actions are customizable and range from a mere
warning in syslog to a complete halt of the system. For more
information about /etc/auditd.conf, refer to The Linux
Audit Framework manual and the manual page of auditd
.conf (auditd.conf(8)).
Setting Up Audit Rules
Audit rules are used to specify which components of your
system are audited. There are three basic types of audit
rules:
• Basic audit system parameters
• File and directory watches
• System call audits
Before creating an audit rule set and before rolling it out
to your system, carefully determine which components to
audit. Extensive auditing causes a substantial logging load.
Make sure that your system provides enough disk space to
store large audit logs and test your audit rule set extensively
before rolling it out to a production system.
Audit rules can either be passed to the audit system by the
command line using auditctl or bundled into a rules le
located under /etc/audit.rules that is read during
the start of the audit daemon:
# basic audit system parameters
-D
-b 8192
-f 1
-e 1
# some file and directory watches
-w /var/log/audit/
-w /etc/auditd.conf -p rxwa
-w /etc/audit.rules -p rxwa
-w /etc/passwd -p rwxa
-w /etc/sysconfig/
# an example system call rule
-a entry,always -S umask
The basic audit system parameters include a rule to delete
any preexisting rules (-D) to avoid clashes with the new
rules, a rule that sets the number of outstanding audit
buffers (-b), the failure ag (-f), and the enable ag (-e):
-b
Depending on the audit load of your system, increase
or decrease the number of outstanding audit buffers. If
there are no more buffers left, the kernel checks the
failure ag for action.
-f
The failure ag controls the kernel's reaction to critical
errors. Possible values are 0(silent), 1(printk, print a
failure message), and 2(panic, bring the system
down—no clean shutdown and risk of data loss or cor-
ruption).
-e
If set to 1, this enables audit and audit contexts for sys-
tem calls. Set to 0, audit is disabled. This ag is used to
enable or disable audit temporarily.
File system watches can be added whenever you want to
track les or directories for unauthorized access. Typical
examples would include watching the audit conguration
and logs and user and security databases. Use permission
ltering to focus on those system calls requesting the per-
missions in which you are interested:
-w /etc/audit.rules -p rxwa
2

The -p ag enables permission ltering. This example has
permission ltering turned on for read, write, execute, and
attribute change permissions.
Note the following limitations to le system watches:
• Directory watches produce less verbose logs than exact
le watches. When in need of detailed le-related
records, enable separate le watches for all les of inter-
est.
•Pathname globbing of any kind is not supported by audit.
Always use the exact pathnames.
•Auditing can only be performed on existing les. Any les
added while the audit daemon is already running are ig-
nored until the audit rule set is updated to watch the
new les.
Assigning keys to your audit rules helps you to identify any
records related to this rule in the logs. An example rule plus
key:
-w /etc/var/log/audit/ -k LOG_audit
The -k option attaches a text string to any event that is
recorded in the logs due to this rule. Using the ausearch
log analyzer, you can easily identify any events related to
this particular rule.
A sample system call audit rule could look like the following:
-a entry,always -S umask
This adds the rule to the system call entry list (-a) and logs
an event whenever this system call is used (entry,al-
ways). The -S option precedes the actual system call,
umask in this example. Using -F, you could add optional
ltering to this rule. For more information about audit rules,
refer to The Linux Audit Framework and the manual page
of auditctl (auditctl(8)).
Generating Reports
Every audit event is recorded in the audit log, /var/log/
audit/audit.log. To avoid having to read the raw audit
log, congure custom audit reports with aureport and run
them regularly. Use the aureport tool to create various types
of reports ltering for different elds of the audit records
in the log. The output of any aureport command is
printed in column format and can easily be piped to other
commands for further processing. Because the aureport
commands are scriptable, you can easily create custom re-
port scripts to run at certain intervals to gather the audit
information for you.
aureport --summary
Run this report to get a rough overview of the current
audit statistics (events, logins, processes, etc.). To get
detailed information about any of the event categories
listed, run individual reports for the event type.
aureport --success
Run this report to get statistics of successful events on
your system. This report includes the same event cate-
gories as the summary report. To get detailed informa-
tion for a particular event type, run the individual report
adding the --success option to lter for successful
events of this type, for example, aureport -f --
success to display all successful le-related events.
aureport --failed
Run this report to get statistics of failed events on your
system. This report includes the same event categories
as the summary report. To get detailed information for
a particular event type, run the individual report adding
the --failed option to lter for failed events of this
type, such as aureport -f --failed to display all
failed le-related events.
aureport -l
Run this command to generate a numbered list of all
login-related events. The report includes date, time, audit
ID, host and terminal used, name of the executable,
success or failure of the attempt, and an event ID.
aureport -p
Run this report to generate a numbered list of all pro-
cess-related events. This command generates a numbered
list of all process events including date, time, process ID,
name of the executable, system call, audit ID, and event
number.
aureport -f
Run this report to generate a numbered list of all le-
related events. This command generates a numbered list
of all process events including date, time, process ID,
name of the executable, system call, audit ID and event
number.
aureport -u
Run this report to nd out which users are running what
executables on your system. This command generates a
numbered list of all user-related events including date,
time, audit ID, terminal used, host, name of the exe-
cutable, and an event ID.
Use the -ts and -te (for start time and end time) options
with any of the above commands to limit your reports to
a certain time frame. Use the -i option with any of these
commands to transform numeric entities to human-readable
text. The following command creates a le report for the
time between 8 am and 5:30 pm on the current day and
converts numeric entries to text.
aureport -ts 8:00 -te 17:30 -f -i
3

Analyzing Audit Log Files and Reports
While aureport helps you generate custom reports focusing
on a certain area, ausearch helps you to nd the detailed
log entry of individual events:
ausearch -a audit_event_id
Run this search to view all records carrying a particular
audit event ID. Each audit event message is logged along
with a message ID consisting of a UNIX epoch time stamp
plus a unique event ID separated by a colon. All events
that are logged from one application's system call have
the same event ID. For example, use ausearch -a
1234 to display all audit events carrying this audit event
ID. As one application's system call may trigger several
events to be logged, you are likely to retrieve more than
one record from the log.
ausearch -ul login_id
Run this search to view records associated with a partic-
ular login user ID. It displays any records related to the
user login ID specied provided that user had been able
to log in successfully. For example, use ausearch -ul
root to list all processes owned by the given login user
ID.
ausearch -k key
Run this search to nd records that contain a certain key
assigned in the audit rule set. For example, use ause-
arch -k CFG_etc to display any records containing
the CFG_etc key.
ausearch -m message_type
Run this search to nd records related to a particular
message type. Examples of valid message types include
PATH,SYSCALL,USER_LOGIN. Invoking ausearch
-m without a message type displays a list of all message
types.
ausearch -f filename
Run this search to nd records containing a certain le-
name. For example, run ausearch -f /foo/bar for
all records related to the /foo/bar le. Using the le-
name alone would work as well, but using relative paths
would not.
ausearch -p process_id
Run this to search for records related to a certain process
ID. For example, use ausearch -p 13368 to search
for all records related to this process ID.
Use the -ts and -te (for start time and end time) options
with any of these commands to limit your reports to a cer-
tain time frame. Use the -i option with any of these to
transform numeric entities to human readable text. The
following command searches for any le event related to
audit.log that took place any time between 8 am and
5:30 pm on the current day and converts numeric entries
to text.
ausearch -ts 8:00 -te 17:30 -f audit.log -i
Analyzing Individual System Calls
Perform dedicated audits of individual processes using the
autrace command. autrace works similarly to the strace
command, but gathers slightly different information. The
output of autrace is written to /var/log/audit/audit
.log and does not look any different from the standard
audit log entries.
When performing an autrace on a process, make sure that
any audit rules are purged from the queue to avoid having
these rules clash with the ones autrace adds itself. Delete
the audit rules with the auditctl -D command.
autrace /usr/bin/less /etc/sysconfig/auditd
Waiting to execute: /usr/bin/less
Cleaning up...
No rules
Trace complete. You can locate the records
with 'ausearch -i -p 7642'
Always use the full path to the executable to autrace. After
the trace is complete, autrace provides you with the event
ID of the trace, so you can analyze the entire data trail with
ausearch. To restore the audit system to use the audit rule
set again, just restart the audit daemon by calling rcauditd
restart.
Audit Tool Set
auditctl
Controls the audit system. Check the audit daemon's
status and rule set, delete rules, or create new ones.
aureport
Create various types of reports from the audit daemon
logs.
ausearch
Create custom queries to search the audit daemon logs.
autrace
Add audit rules to trace a process. Similar to strace.
rcauditd
Controls the audit init script.
Files
/etc/auditd.conf
Contains conguration options specic to the audit
daemon, such as log le location, log rotation, maximum
size of the log le, and various actions to take when the
system starts to run low on disk space.
/etc/sysconfig/auditd
Controls conguration aspects of auditd that are not
covered in /etc/auditd.conf, such as the locale to
use with audit, the use of audit contexts with system
calls, and whether rules and watches should be deleted
on shutdown of the system.
4

/etc/audit.rules
Controls the rules auditd processes to track system calls
and le and directory access.
/var/log/audit/audit.log
The audit log le.
For More Information
For a more detailed introduction to the Linux audit frame-
work, refer to the The Linux Audit Framework manual that
is available at http://www.novell.com/
documentation/sles10/.
5

Created by SUSE® with XSL-FO
6