In this video, we'll talk about auditing.
So logging is what is used for writing messages that were generated by specific events to
log files.
Logging is typically initiated by services.
Auditing is much more detailed.
It's a system feature that works at the kernel level and you can use it to do a deep investigation
of what is happening on a system.
To use auditing, the auditd service must be operational.
And that's not always the case by default, so check in systemd if it is running.
And the auditctl command can be used to write specific rules about events that should be
audited.
So you can tweak for yourself and determine what you want to be audited and what not.
In order to do so, you need to understand what to audit.
Well, audit for simple activity using permissions is what you can do.
So there is read and write and execute and attribute change and all of these can be monitored.
You can also do more advanced auditing to have a look at system calls.
Use the minus uppercase S option with auditctl to do so.
Now when you audit system calls, it's a bit more complex because you must specify the
target architecture.
Now if you write your audit messages, it's always a good idea to use the option minus
k followed by a key.
And this key is an identifier.
Because next in the audit log, you can use this key to figure out what has been logged.
When you are auditing, you need to take care of the user IDs that are used.
Because all the user IDs work a little bit differently.
In auditing, you will find the AUID.
That is the audit UID.
And that is the UID that the user originally logged in with.
So regardless of what you do using SU or SUDU, you will always see the underlying UID
in the AUID.
EUID is the effective user ID.
And that's the user ID that was used to perform the operation.
So if you are in an SU shell, your EUID will be the user that you SU'd into.
OUID is the object user ID.
And that is the user ID that is used by the target process.
And now we have the UID, which is the real ID of the user that started the process.
To add audit rules, auditctl is the command to use.
Use for instance auditctl minus W, etcmotd.
So that is a watch.
We will watch the etcmotd file.
Minus P rwxa.
So we are watching for permissions read, write, execute, and attribute change.
So anything that happens to this cell will be audited.
And minus k test audit is going to write the label test audit.
Now if you want to monitor the output of auditctl, you are going to watch the audit log.
We'll talk about it shortly.
Now anything you type with auditctl is here and now only.
It's not persistent.
If you want to make it persistent, you need to write to etcauditrules.d audit.rules.
It's pretty easy.
It's the same command without auditctl in front of it.
And you can also make the current rules immutable by adding minus E2 to the end of the audit.rules
file.
Auditing is a security feature, and by adding minus E2, you prevent that an intruder is
going to disable all of your audit rules.
To investigate the audited events, you can read the audit log directly.
Some people think it's not very readable.
I think you just need to practice a little bit to get used to it.
But because some people think it's not very readable, there are specialized utilities
like au-search, which helps you to search for specific events.
Use for instance au-search minus k admin underscore access to show all events that have the admin
underscore access label.
Hey, you know, au-search is just a fancy way of doing a grep.
If you do a grep admin underscore access in audit.log, you see the same result.
But au-search is frequently used.
So another example is au-search minus mavc.
That will show you all messages that have been logged with the message avc, and that
is SE Linux related.
We'll talk about that later.
au-search minus mavc minus ts today will do the same, but only for messages that have
the timestamp of today.
And au-search minus mevc minus ts today minus chtpd will further fine-tune and only show
messages related to the httpd service.
Let me show you a couple of useful examples.
So to start with, audit ctl minus l is showing that no rules are available.
And I'm going to use audit ctl minus w etc pass wd minus p wa minus k pass wd changes.
I like to put my keys in updates.
Ignore the line about old-style watch rules.
The rule is still working, and this is the kind of information you need to know about
for your exam.
Good.
I'm going to use user at Anna.
Already exists.
Oh, boy.
User at Bia.
And now I'm going to do a grab of pass wd underscore changes in var log audit audit.log.
And there we can see what has been logged.
So we can see the actual line, a system call.
On architecture, this system call number.
We don't care about the system call number too much.
What we care about is that PID 4125.
That might be interesting.
So PID 4125, AUID 1000.
So the audit user ID, that's the original user, is user 1000.
The UID is zero.
So we can see it has happened from sudo minus i or something environment, which is confirmed
by the EUID.
And there we can see what has happened.
User has been user at, and the key is password changes.
So a user has been added.
Now you might be wondering when.
Well, that is a funny one.
You can see the when right here.
This is the time.
Now the thing is that this time is not very readable, but if you use date, minus D, and
then you use an at sign followed by this timestamp, which is an epoch, you get a nicely translated
timestamp to find out when exactly the password change has happened.
Now let's do another example.
Audit CTL minus A always comma exit minus S ABJ time X minus S set time of day.
This minus S is referring to system calls.
These are low-level system operations.
And if they happen, I want to log something with the key time change.
So anytime a time change is going to happen, it will be logged.
Now do we have it?
Rep on time change on var log audit.log.
And look at that.
We can see something.
Well, do we?
No.
The type is config change.
Config change identifies the rule that has been added.
We now need to wait until something is changing the time.
Honestly, I don't want to change the time because time synchronization is used here.
But if you want to, time minus S 13 colon 20, and then we grab it again and, oh, it's
not yet there.
Well, it will get there eventually.
Let's have a look at another one, which is very interesting.
Audit CTL minus A always comma exit.
This minus A is identifying when you want to do the audit.
And here, the always exit means that we always do the audit at the exit of the system call
that we are monitoring.
Now what do I want to do?
I want to filter on there is slash home.
So we are filtering activity in the slash home directory.
Min F UID is zero.
So the effective user ID is zero.
And min C AUID none equals object UID.
The AUID is the user ID of the original user.
The object user ID, that is the user ID of the object that is accessed.
So that will be the user home directory.
And then we are going to log spying.
And why do we do this?
Because this rule makes sure that if anybody from an SU shell is accessing a home directory
that doesn't correspond to the home directory of their original user, well, then the message
will be logged.