Re: Auditing TCP connections

Re: Auditing TCP connections

[Steve Grubb]

On Tuesday 08 December 2009 11:21:14 pm Data Lineage wrote:
> Is my understanding correct that the Linux Audit framework currently
> only logs the remote endpoint of TCP connections?

It records what is passed to the connect syscall or what accept is seeing.

> That is, when a connect() call occurs, only the remote IP and port are
> logged, not the local ones?

That is probably correct. I don't recall seeing duplicate network records

> If so, would it be possible to add the local end point into the audit
>  trail?

I'm pretty sure it could be patched to provide that if its not. I think we 
might want a new record type or some way of distinguishing which record is 
local and remote.

I have been reading through the new OSPP from NIAP and it calls out for 
selective audit based on network address, too. So, it would kind of fit with 
what will be required going forward.

So...were you planning to send a patch or is this a request for us to write 
one? 

-Steve