Auditing tcpdump&co

Auditing tcpdump&co

[Jure Simsic]

[-- Attachment #1.1: Type: text/plain, Size: 680 bytes --]

Hi,

I'm trying to catch all events of any net sniffers aka tcpdump, snoop,
ethereal... I think I managed to make a rule that will do that:

-a entry,always -S socketcall -F euid=0 -F a0=3

I've played around and I think it does the trick. Do you see any problems
with this rule?

The problem I'm trying to solve now is how to get a daily report of all such
events. I was trying to filter it on
ausearch -m SYSCALL -sc socketcall -ue 0
but I get all possilble sshd,ftpd and the bunch as well.. I could do post
processing with a whitelist and ignore all I know are ok, but it would be
much nicer if I could get the search a bit narrower in the first place. Any
ideas?

Thanks
Jure

[-- Attachment #1.2: Type: text/html, Size: 741 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Auditing tcpdump&co

[Steve Grubb]

On Saturday, May 29, 2010 03:15:25 pm Jure Simsic wrote:
> I'm trying to catch all events of any net sniffers aka tcpdump, snoop,
> ethereal... I think I managed to make a rule that will do that:

This is hardwired into the linux kernel. As long as auditing is enabled, you 
will get ANOM_PROMISCUOUS events.


> -a entry,always -S socketcall -F euid=0 -F a0=3
> 
> I've played around and I think it does the trick. Do you see any problems
> with this rule?

Not needed.


> The problem I'm trying to solve now is how to get a daily report of all
> such events. I was trying to filter it on
> ausearch -m SYSCALL -sc socketcall -ue 0

aureport --start today --anomaly --summary -i

-Steve