Hello, and welcome to this video on the Linux Auditing System on Oracle Linux 8.
In this video we'll describe the purpose of the Linux Auditing System.
And we'll also demonstrate the command-line interface to create audit rules and search
for and report on violation of these rules. Auditing tracks user activity and system operations
on your system. Auditing does not implement additional security.
It reports only on security violations. Auditing can affect system performance depending
on the amount of information that is logged. Test each rule to determine impact on performance.
To view the Linux Auditing System configuration files and run auditing commands, open a terminal
to your host system. In this demonstration, we use a fully patched
Oracle Linux 8 instance on Oracle Cloud Infrastructure. So let's get started.
First we will verify the audit package is installed by running the command: sudo -E
dnf list installed |grep audit For this demonstration, the package is installed
already. Next we will verify the auditd service is
running by running the command: sudo systemctl status auditd
Again, for this demonstration, the service running and is enabled to start at boot time.
Next we will view the audit daemon configuration file by running the command: sudo cat /etc/audit/auditd.conf
We'll view the man page on this file by running the command: man auditd.conf
This auditd.conf file contains configuration information specific to the audit daemon.
Each line should contain one configuration keyword, an equal sign, and then followed
by appropriate configuration information. Descriptions of the keywords are given.
For example, log_file specifies the full path name to the log file where audit records will
be stored. I'll exit the man page and we can see that
log_file in the audit daemon configuration file is set to /var/log/audit/audit.log by
default. So this is the log file where audit records
will be stored. I'll clear the screen and next we'll view
the audit rules file by running the command: sudo cat /etc/audit/audit.rules
As the filename implies, the audit rules file contains the audit rules.
Initially, this file only contains control rules.
Control rules generally involve configuring the audit system rather than telling it what
to watch for. These options are described on the auditctl
man page. We'll view the auditctl man page by running
the command: man auditctl Under CONFIGURATION OPTIONS, we see that the
-D entry deletes all rules. The -b option sets the maximum number of outstanding
audit buffers allowed. The -f option sets the failure mode which
tells the kernel how to handle critical errors. The --backlog_wait_time sets the time for
the kernel to wait when the backlog limit is reached before queuing more audit events
to be transferred to auditd. Again, these options are referred to as control
rules because the involve configuring the audit system.
Another type of rules are called file system rules.
File system rules allow you to log, or watch, access to files or directories.
These rules use the -w, or watch option. I'll search for -w and you can see that you
use the -w option to insert a watch for the file system object at a path argument.
Before we create a watch rule, I'll exit the man page, and clear the screen, and we'll
list the audit rules by running the command: sudo auditctl -l
The output indicates that there are currently no audit rules.
We saw that there were control rules, but these control rules are not shown when running
the auditctl -l command. We'll create a file system rule using the
auditctl -w command. This file system rule watches the /etc/passwd
file. An audit event will be logged whenever a write
occurs on the /etc/passwd file. I'll type the command: sudo auditctl -w /etc/passwd
-p w -k passwd The file name to watch is /etc/passwd.
The -p option specifies the permissions to watch for, which is w, or write.
The -k option specifies a key name, which can be anything, but in this example, I'll
use passwd as the key name. As we'll see in a few seconds, the key name
can be used by the ausearch command. Now if I run the auditctl -l command to list
the audit rules, we see our new file system audit rule.
To test this rule, I'll run the adduser command to add user john.
This command causes a write to the /etc/passwd file.
So I'll type the command: sudo useradd john Now I'll use the ausearch command to search
for events by key name. Our key name that we specified in the file
system audit rule is passwd, so I'll type the command: sudo ausearch -k passwd
Our output contains 3 audit events. Each event has a time stamp.
Each event has an event ID and one or more message types.
In this example, the event ID for the 1st event is 78203.
The event ID for the 2nd event is 78216. And the event ID for the 3rd event is 78219.
I'll point of some of the message types. A PATH event is generated for each path passed
to a system call. CWD is the current working directory at the
time of the system call. SYSCALL provides information on the system
call that triggered the audit event. Explanation of all the information in an audit
record is beyond the scope of this video. You can use the ausearch command to query
the audit logs based on different search criteria. I'll clear the screen and type the command
ausearch without any options. The output lists all of the search options
and also is helpful in describing the information contained in an audit log record.
The last command we'll show in this video is the aureport command.
I'll clear the screen and type the command: aureport -f
Here we see the two events logged when we ran the useradd command which caused a write
on the /etc/passwd file. The date and time are given, as well as a
numeric representation of the system calls that triggered the events and the event IDs.
You can view the man page for the aureport command to see all of the available command
options. This concludes the demonstration portion of
this video. Thank you for watching and please check our
additional information on Oracle Linux 8 in the Oracle Linux 8 Documentation or the Oracle
Linux Learning Library.