From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Security Auditd Config for Enterprises
Date: Fri, 04 Sep 2020 11:41:50 -0400 [thread overview]
Message-ID: <2114738.iZASKD2KPV@x2> (raw)
In-Reply-To: <CAHvE9BK5+oRZrUCOkJ+Ong8z-R2ZVOmi-CZfddXJboRqWOGRkA@mail.gmail.com>
Hello,
On Friday, September 4, 2020 9:38:33 AM EDT Rohit Nambiar wrote:
> Apologies if this topic has already been discussed before, I couldn't find
> an easy way to sift through older archives.
>
> Is there an auditd rule set which offers a reasonable level of security
> visibility and has been tested on enterprise production systems? And if
> such a rule set can be shared here?
>
> I'm looking for a base document to deploy/modify for use within my
> organization. Many thanks in advance.
The audit system ships a set of pre-written rules for various scenarios. It
should be a matter of locating them over in /usr/share and copying them to
/etc/audit/rules.d/
The rules that I would recommend are the OSPP rules. They form the basis of
the STIG auditing requirements. And I believe CIS's guidance would have
similar rules. That means you would copy the following files (you can also get
these from github if they are not on your system):
10-base-config.rules
11-loginuid.rules
30-ospp-v42-1-create-failed.rules
30-ospp-v42-2-modify-failed.rules
30-ospp-v42-3-access-failed.rules
30-ospp-v42-4-delete-failed.rules
30-ospp-v42-5-perm-change-failed.rules
30-ospp-v42-6-owner-change-failed.rules
43-module-load.rules
The above is designed tro detect violations of the security policy. Meaning
someone trying to access something they do not have permissions for. If you
also need to audit successful events, then copy the corresponging success
rules. However, when you capture all success events, then system update will
be a high volume of events.
HTH,
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2020-09-04 15:42 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-04 13:38 Security Auditd Config for Enterprises Rohit Nambiar
2020-09-04 15:27 ` Christian, Mark
2020-09-04 15:41 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2114738.iZASKD2KPV@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox