rhel6/7 question

rhel6/7 question

[LC Bruzenak]

[-- Attachment #1.1: Type: text/plain, Size: 239 bytes --]

Are there any issues with a RHEL7 auditd collecting events from RHEL6
submitters?
How about any interpretation issues, on the RHEL7 side, of these events?

Thanks in advance,
LCB

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com



[-- Attachment #1.2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 2193 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: rhel6/7 question

[Steve Grubb]

On Friday, September 12, 2014 09:06:39 AM LC Bruzenak wrote:
> Are there any issues with a RHEL7 auditd collecting events from RHEL6
> submitters?

To my knowlege, there are no issues. Its pretty much the same software on both 
systems.

> How about any interpretation issues, on the RHEL7 side, of these events?

Just the usual user name/group interpretation issue. But if you spot anything 
else, let me know. With the ausearch-test application, I have been working to 
make interpretation and searching universally correct. This is only achieved 
with the latest audit packages.

As an aside, I have found that we also need an audit validation suite. What 
this would do is have someone start a system, login, logout, log back in, shut 
down the system, reboot and run the test to see if all necessary events have 
been generated, no duplicates, no spurious events, and fields are correct.

-Steve

Re: rhel6/7 question

[Steve Grubb]

On Friday, September 12, 2014 10:22:31 AM Steve Grubb wrote:
> As an aside, I have found that we also need an audit validation suite. What
> this would do is have someone start a system, login, logout, log back in,
> shut down the system, reboot and run the test to see if all necessary
> events have been generated, no duplicates, no spurious events, and fields
> are correct.

Since people have asked about this off list...

I have uploaded a state diagram of how the audit system is supposed to work to 
my people page: http://people.redhat.com/sgrubb/audit/

This only includes the system events that give the user session context. The 
whole user session can do anything based on the local rules/selinux 
settings/file permissions. The point is to define the boundaries that can be 
used to constrain the possible user events.

I'll upload the suite in its current form a bit later. It is a work in 
progress...but identifies systemd as not being consistent in sending events. 
Not to mention lightdm not being audit aware at all...

-Steve

Re: rhel6/7 question

[Steve Grubb]

On Friday, September 12, 2014 11:14:57 AM Steve Grubb wrote:
> I'll upload the suite in its current form a bit later. It is a work in 
> progress...but identifies systemd as not being consistent in sending
> events.  Not to mention lightdm not being audit aware at all...

I re-organized the project page and put a place at the bottom for test suites. 
The 0.1 version can now be found at:

http://people.redhat.com/sgrubb/audit/audit-validation-0.1.tar.gz

It is a work in progress. It has a long way to go. It needs help. Especially 
in correcting apps.

-Steve