Command linux auditd – A Guide to Using Auditd for System Monitoring

When it comes to securing a Linux system, one of the most valuable tools at your disposal is auditd. Whether you're an experienced sysadmin or just starting to dive into the world of system monitoring, the auditd command provides a powerful way to track activity and keep an eye on your system's security. So, what exactly is auditd, and how can you leverage it to monitor your Linux system effectively? Let’s explore!

What is auditd?

Auditd, or the Linux Audit Daemon, is a user-space utility that allows you to track and record security-related events on a Linux system. Think of it as a watchdog that keeps a detailed log of everything happening on your machine, from user logins to file access. The audit logs can help administrators and security teams detect suspicious activities, such as unauthorized access, file modifications, or attempts to exploit system vulnerabilities.

With auditd, you can configure detailed audit rules to track specific events, allowing for in-depth security analysis. This makes it a crucial tool for compliance auditing, incident response, and general system monitoring.

Why Use auditd?

There are several compelling reasons to use auditd on your Linux systems:

• Security monitoring: It helps you track who is accessing your system, what files they are accessing, and whether any unauthorized modifications are happening.
• Compliance: Many industries require detailed audit logs to meet security standards. auditd can assist in maintaining those logs.
• Incident response: When something goes wrong, auditd’s logs can help you reconstruct events and identify the source of the problem.
• Forensics: In case of a breach, audit logs provide essential information for forensic analysis.

Installing and Configuring auditd

Before diving into command linux auditd examples, let's make sure you have auditd installed and properly configured. On most Linux distributions, auditd is included by default, but you can install it manually if needed.

To install auditd on a Debian-based system (like Ubuntu), use the following command:

sudo apt-get install auditd

On Red Hat-based systems (like CentOS), use this command instead:

sudo yum install audit

Once installed, auditd is usually started automatically, but you can ensure it’s running by using the following command:

sudo systemctl start auditd

To check its status, use:

sudo systemctl status auditd

Configuring auditd

Auditd’s configuration file is located at /etc/audit/auditd.conf. This file contains settings for how the audit daemon behaves, including log file locations, the maximum log file size, and how logs are rotated. Let’s briefly go over some of the most common settings:

• log_file: Specifies where audit logs will be saved. By default, it’s set to /var/log/audit/audit.log.
• max_log_file: Determines the maximum size of a single audit log file before it gets rotated. The default is 6 MB.
• num_logs: Defines the number of log files to keep. Older logs will be deleted once this limit is reached.
• log_format: Specifies the format of the logs, with options such as ENRICHED (default) or RAW.

Once you’ve configured your settings, don’t forget to restart auditd to apply the changes:

sudo systemctl restart auditd

Using the auditctl Command

The auditctl command is used to configure auditd’s rules for what events to log. These rules define the kinds of actions you want to monitor, such as file access or user login attempts. Let’s go over a few examples of how to use the auditctl command effectively.

Example 1: Monitoring File Access

If you want to track who is accessing a specific file or directory on your system, you can use auditctl to create a rule that monitors those events. For example, let’s say you want to monitor access to the /etc/passwd file, which contains important system information.

sudo auditctl -w /etc/passwd -p war -k passwd_access

In this command:

• -w specifies the file or directory to watch.
• -p sets the permissions to monitor. In this case, war means watch for writes (w), attribute changes (a), and read accesses (r).
• -k assigns a key to the rule for easy identification in the logs. Here, the key is passwd_access.

This rule will log all attempts to read, write, or modify the /etc/passwd file. The logs will be stored in /var/log/audit/audit.log.

Example 2: Monitoring User Logins

If you're interested in tracking user login attempts, you can create a rule to monitor the sshd service. Here’s a simple command that will log every successful and unsuccessful login attempt:

sudo auditctl -w /var/log/secure -p wa -k ssh_login

In this case:

• -w points to the /var/log/secure log file, which stores authentication attempts.
• -p monitors write (w) and attribute changes (a) to the file.
• -k assigns the ssh_login key to the rule.

This rule will track any changes to the /var/log/secure file, which contains SSH login attempts. By monitoring this log, you can identify any failed or successful login attempts.

Example 3: Monitoring System Calls

Auditd can also track system calls, which are low-level operations that the kernel performs in response to user requests. For example, if you want to monitor all attempts to execute the chmod command (which changes file permissions), you can use the following command:

sudo auditctl -a always,exit -F arch=b64 -S chmod -k chmod_command

In this example:

• -a always,exit specifies that the rule should trigger whenever the chmod command is executed (both entry and exit points of the system call).
• -F arch=b64 specifies that we are monitoring 64-bit architecture.
• -S chmod indicates the system call to monitor (in this case, chmod).
• -k assigns the chmod_command key to this rule.

This rule will log every instance of the chmod system call, giving you a comprehensive audit trail of permission changes.

Viewing the Logs

After you've set up your audit rules, you can view the logs using the ausearch command. This command allows you to search through the audit logs based on various criteria, such as event type, date, or the key you assigned to a rule. For example, to search for all events related to the passwd_access key, you can run:

sudo ausearch -k passwd_access

Alternatively, you can view the raw audit logs directly by inspecting the /var/log/audit/audit.log file. However, using ausearch is much more efficient, especially when dealing with large log files.

Best Practices for Using auditd

Now that you have a basic understanding of how to use command linux auditd, here are a few best practices to follow when working with auditd:

• Define clear audit rules: Focus on the most critical events to avoid overwhelming your logs with unnecessary information.
• Regularly review audit logs: Periodically check the logs to spot potential security incidents before they escalate.
• Use a centralized log management system: If you're managing multiple systems, consider using tools like syslog or ELK (Elasticsearch, Logstash, Kibana) to aggregate your audit logs for easier analysis.
• Rotate audit logs: Regularly rotate your logs to avoid filling up your disk space, especially if you’re monitoring many events.

Conclusion

The command linux auditd is a powerful tool for maintaining security and compliance on your Linux systems. By configuring audit rules, monitoring specific system events, and analyzing audit logs, you can gain valuable insights into your system’s activity. Whether you're monitoring file access, user logins, or system calls, auditd gives you the visibility you need to keep your Linux system secure and compliant. So start exploring auditd today and take your system monitoring to the next level!