From mboxrd@z Thu Jan 1 00:00:00 1970 From: Burn Alting Subject: Advice on enriching logs with user and group names before moving them to a central log repository Date: Thu, 02 Aug 2012 20:54:14 +1000 Message-ID: <1343904854.4074.76.camel@swtf> Reply-To: burn@swtf.dyndns.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4717610060278852443==" Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q72AsbR3031806 for ; Thu, 2 Aug 2012 06:54:37 -0400 Received: from gateway.swtf.dyndns.org (203-219-87-38.static.tpgi.com.au [203.219.87.38]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q72AsZ6U005835 for ; Thu, 2 Aug 2012 06:54:36 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by gateway.swtf.dyndns.org (Postfix) with ESMTP id 913EE24D0055 for ; Thu, 2 Aug 2012 20:51:22 +1000 (EST) Received: from gateway.swtf.dyndns.org ([127.0.0.1]) by localhost (gateway.swtf.dyndns.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uVhdBQU8Q6DQ for ; Thu, 2 Aug 2012 20:51:21 +1000 (EST) Received: from localhost (localhost.localdomain [127.0.0.1]) by gateway.swtf.dyndns.org (Postfix) with ESMTP id 934C824D0056 for ; Thu, 2 Aug 2012 20:51:21 +1000 (EST) Received: from [192.168.2.100] (unknown [192.168.2.100]) by gateway.swtf.dyndns.org (Postfix) with ESMTP id 6FB9524D0055 for ; Thu, 2 Aug 2012 20:51:21 +1000 (EST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============4717610060278852443== Content-Type: multipart/alternative; boundary="=-Ehm83P4qO2A5ae8tht5D" --=-Ehm83P4qO2A5ae8tht5D Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Hi, I have a scenario of a mixed collection of Linux systems, some that have users authenticate via a central ldap, others have local (/etc/passwd) authentication. This means I cannot 100% depend that the user name say, fred, with uid 1000, has the same uid on every machine he has an account on. Thus before I send my logs to a central server, I want to enrich them with user and group names I validate at the local machine. That is, I want to change an event's ids from .... uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=43 sgid=43 fsgid=43 .... to .... uid=1000(fred) gid=1000(prog) euid=1000(fred) suid=1000(fred) fsuid=1000(fred) egid=43(utmp) sgid=43(utmp) fsgid=43(utmp) .... I BELIEVE my best approach is use the event multiplexor (audispd) to convert raw logs via a child program, say based on the sample code, audisp-example (i.e. using the auparse library) and send the output of this audisp-example variant to syslog to get the event to a central repository. Is this the best approach? Are there parameters I should consider for audisp.conf (e.g. q_depth = 99999)? Does such a configuration option in audisp.conf suggest I make the buffer size set in audit.rules to something higher? Is there any consideration to having auditd have a option to directly generate user and group names in addition to uid and gids? Thanks in advance Burn --=-Ehm83P4qO2A5ae8tht5D Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: 7bit Hi,

I have a scenario of a mixed collection of Linux systems, some that have users authenticate via a central ldap, others have local (/etc/passwd) authentication.
This means I cannot 100% depend that the user name say, fred, with uid 1000, has the same uid on every machine he has an account on.  Thus before I send my logs to
a central server, I want to enrich them with user and group names I validate at the local machine. That is, I want to change an event's ids from
.... uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=43 sgid=43 fsgid=43 ....
to
.... uid=1000(fred) gid=1000(prog) euid=1000(fred) suid=1000(fred) fsuid=1000(fred) egid=43(utmp) sgid=43(utmp) fsgid=43(utmp) ....

I BELIEVE my best approach is use the event multiplexor (audispd) to convert raw logs via a child program, say based on the sample code, audisp-example  (i.e. using the auparse library)
and send the output  of this audisp-example variant  to syslog to get the event to a central repository.

Is this the best approach?

Are there parameters I should consider for audisp.conf (e.g. q_depth = 99999)? Does such a configuration option in audisp.conf suggest I make the buffer size set in audit.rules to something higher?

Is there any consideration to having auditd have a option to directly generate user and group names in addition to uid and gids?

Thanks in advance

Burn --=-Ehm83P4qO2A5ae8tht5D-- --===============4717610060278852443== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============4717610060278852443==--