From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: [RFC] programmatic IDS routing Date: Wed, 19 Mar 2008 15:48:54 -0400 Message-ID: <1205956134.6333.4.camel@localhost.localdomain> References: <200803191302.48434.sgrubb@redhat.com> <200803191440.02743.sgrubb@redhat.com> <47E163D9.4050502@hp.com> <200803191528.55805.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200803191528.55805.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: Linux Audit , Valdis.Kletnieks@vt.edu List-Id: linux-audit@redhat.com On Wed, 2008-03-19 at 15:28 -0400, Steve Grubb wrote: > On Wednesday 19 March 2008 15:04:57 Linda Knippers wrote: > > I'm not sure why all of the above apply. > > Because this IDS is part of the audit system. > > > If an IDS has a dependency on audit and specific audit rules to get the > > information it needs, it can use the information in its config file to > > construct the audit rules it needs. > > Then you surely have duplicate rules controlled by 2 systems. The first rule > in the audit.rules file is -D which would delete not only the audit event > rules for archival purposes, but any IDS placed rules. There is not a simple > way of deleting the rules placed by auditctl vs the ones placed by the IDS. > The IDS system would also need to be prodded to reload its set of rules > again. If someone does -D they lose no matter what no matter how we solve this :) I find it objectionable that they sysadmin has to learn some new arbitrary key requirements. Could the ids system parse its own configuration file and automatically generating audit.rules.ids which is just cat'ed onto the end of audit.rules for purposes of statup scripts and things like that? Then I wouldn't have a problem with it setting its own key however it wanted the key. Although admittedly I have no idea what happens if you do -a exit,always -S all -k hey2 -a exit,always -S all -k key2