From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: audisp-prelude problems Date: Wed, 3 Dec 2008 08:46:41 -0500 Message-ID: <200812030846.42362.sgrubb@redhat.com> References: <37996.193.230.245.33.1228299808.squirrel@secure.myclar.ro> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <37996.193.230.245.33.1228299808.squirrel@secure.myclar.ro> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wednesday 03 December 2008 05:23:28 Loredan Stancu wrote: > I'm testing version 1.7.9 of audit using audisp-prelude plugin and I have > some problems: Might also be helpful to know which distribution and release, IOW Fedora 10? > 1. audisp-prelude plugin is not generating events when a user is logged in. Do you find USER_LOGIN events? ausearch --start today -m USER_LOGIN Without that, you won't see anything. > 2. audisp-prelude plugin is not sending uid, gid to a prelude-manager For which event? The loginuid is mostly what I concentrated on since that tells you how they got into the machine. > 3. No events are generate for watched files/exec/mk_exe if no tow -k > options are specified in the rule. One of the -k options should contain > '-k ids-type-severity' and another -k may contain anything. If you specify > only one -k options no events are generated. You need 2 rules to cover this: auditctl -a exit,always -S fchmodat -F dir=/home -F 'a2&0111' -F filetype=file -k ids-mkexe-hi auditctl -a exit,always -S fchmod,chmod -F dir=/home -F 'a1&0111' -F filetype=file -k ids-mkexe-hi It works fine on my system. Also note that it depends on having a recent kernel. > Another question is how I can use audisp-remote to send events somewhere > remote? Assuming you are using Fedora, to set this up on client machines, you will need to install the audispd-plugins package. Then you need to set the remote_server and port in the /etc/audisp/audisp-remote.conf file. The server that aggregates the logs does not need the plugins package installed. It should have the tcp_listen_port set to the same port as the clients in the /etc/audit/auditd.conf file. Then semanage needs to have the same port in its database since the audit daemon is protected by SE Linux. Assuming that you wanted the audit daemon listening on port 1000, you would run: semanage port -a -t audit_port_t -p tcp 1000. The last step is to edit the /etc/hosts.allow file to configure tcp_wrappers to allow the machines or subnets that the daemon should allow connections from. -Steve