From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Gruhn Subject: Remote audit clients on RHEL 5.2 Date: Thu, 12 Feb 2009 12:01:33 -0500 Message-ID: <499455ED.3060208@groupw.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0757075610==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n1CH1oXv018307 for ; Thu, 12 Feb 2009 12:01:50 -0500 Received: from smtp.group-w-inc.com (group-w-inc.com [70.164.45.3]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n1CH1Y9h022481 for ; Thu, 12 Feb 2009 12:01:35 -0500 Received: from smtp.group-w-inc.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with ESMTP id BFA9CDA009F for ; Thu, 12 Feb 2009 12:01:33 -0500 (EST) Received: from [10.1.1.218] (dgruhn-f9.group-w-inc.com [10.1.1.218]) by smtp.group-w-inc.com (Postfix) with ESMTP id 71E29DA0094 for ; Thu, 12 Feb 2009 12:01:33 -0500 (EST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============0757075610== Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Greetings,

I have a 64 bit EL 5.2 system that I have built and installed all of the necessary packages for the latest audit (1.7.11-1), prelude and prewikka. (Does anyone need any binary RPM packages?).

This all seems to be working fine on the central cluster server and now I'm trying to set up clients in the cluster nodes to report their audit information to the server. I've found the RHEL 5.3 release notes where it says:

In addition to the listed enhancements, these updated audit packages also include a new feature to allow a server to aggregate the logs of remote systems. The following instructions can be followed to enable this feature:
The audispd-plugins package should be installed on all clients (but need not be installed on the server), and the parameters for "remote_server" and "port" should be set in the /etc/audisp/audisp-remote.conf configuration file.

On the server, which aggregates the logs, the "tcp_listen_port" parameter in the /etc/audit/auditd.conf file must be set to the same port number as the clients.
Because the auditd daemon is protected by SELinux, semanage (the SELinux policy management tool) must also have the same port listed in its database. If the server and client machines had all been configured to use port 1000, for example, then running this command would accomplish this:
semanage port -a -t audit_port_t -p tcp 1000
      
The final step in configuring remote log aggregation is to edit the /etc/hosts.allow configuration file to inform tcp_wrappers which machines or subnets the auditd daemon should allow connections from.

I'm on the step where I'm trying to run the semanage command to let selinux know that port 60 (in my case) is acceptable for audit to use but I get the following error message when I run the command:

# semanage port -a -t audit_port_t -p tcp 60 libsepol.context_from_record: type audit_port_t is not defined libsepol.context_from_record: could not create context structure libsepol.port_from_record: could not create port structure for range 60:60 (tcp) libsepol.sepol_port_modify: could not load port range 60 - 60 (tcp) libsemanage.dbase_policydb_modify: could not modify record value libsemanage.semanage_base_merge_components: could not merge local modifications into policy /usr/sbin/semanage: Could not add port tcp/60

I'm not much of a wiz at selinux, but I can tell that the audit_port_t type doesn't exist. I'm stuck here because:

1) I don;t know how to create new types in selinux
2) Even if I figured that out, I don't know how auditd would know to use that.

I've looked at the auditd executable, it has types like this:
-rwxr-x--- root root system_u:object_r:auditd_exec_t /sbin/auditd

Could someone give me some pointers and/or point me to something I could read to get me going?

Thanks

Dan

--
Dan Gruhn, Group W Inc.

--===============0757075610== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0757075610==--