For some time I have been writing an ansible playbook to provision a fresh CentOS7 installation with docker and the most secure setup possible. On security regards initially I have just provisioned it with fail2ban, but reading one of the weekly mail lists I subscribe to I have learned about a tool called audit or auditd (these tend to be their names on the package managers, and the systemd service file is usually auditd.service). It is a powerful tool that you can use to monitor specific files or directories for changes (or even reads), with a really amazing level of detail. It also is quite flexible and provides cli tools that can give you reports, help with searching for specific events or even tracing a binary or PID for what it is doing.

• auditctl: this is where you manage (CRUD) your rules.
• ausearch: search for events. Sometimes it can be better to pipe its output to aureport, which gives more human digestable information on the events.
• aureport: Gives human-readable reports of events on your system (e.g., failed login attempts).
• autrace : analize a process and view the files and system calls used by it. Below I have written a small cheatsheet for each one of these tools:

auditctl

IMPORTANT: A list of linux syscalls can be obtained here: http://syscalls.kernelgrok.com/

• See the current status: $ sudo auditctl -s
• List rules: $ auditctl -l
• Delete ALL rules: $ auditctl -D
• Selectively delete rules: $ auditctl -d never,task
• Watch for a directory: $ auditctl -w /home/user/test_dir/ -k test_watch # args: -w [path-of-directory-to-monitor] -k [tag-to-this-rule-here]
• Remove a watch: $ auditctl -W /home/user/test_dir -k test_watch
• Watch for a file: $ auditctl -w /etc/passwd -p wa -k passwd_watch # args: -p [permissions to monitor - [r]ead, [w]rite, e[x]ecute, or [a]tributes. If you do not specify -p, even an ls on the file will trigger an event.
• Watch for a list of linux kernel syscalls on a given subdirectory: $ sudo auditctl -a always,exit -S adjtimex,settimeofday -F dir=/etc -k time-change # args: -S [list_of_syscalls_here] -F dir=[dir_where_to_monitor_these_syscalls]
• See all syscalls made by a specific program: $ sudo auditctl -a always,exit -S all -F pid=1005
• Temporarily disabling the auditing process: $ sudo auditctl -e 0
• Re-enabling a temporarily disabled auditing process: $ sudo auditctl -e 1
• Locking the configuration to be immutable, and the daemon to not be stopped: $ sudo auditctl -e 2. You need to reboot the server to be able to change the configuration again or stop the daemon.
• Put all our rules into a file:

$ vim /etc/audit/rules.d/[choose-a-nice-name-here].rules
-D
-w /home/user/test_dir/ -k test_watch
-w /etc/passwd -p wa -k passwd_watch

ausearch

• Search for specific events: $ ausearch -k test_watch # args: -k [tag-to-the-rule-you-want-here]
• Search for specific events and pipe them through a human readable report: $ ausearch -k test_watch | aureport -f -i
• Search for a specific event_id: $ sudo ausearch -a 27020

aureport

• Summary report: $ aureport # A high "Number of failed authentications" here e.g. could mean someone trying to access this machine without permission
• Authentication report: $ aureport -au
• Authentication report filtering failed attempts: $ aureport -au | grep no
• Users report: $ aureport -u -i
• All command executions on the server: $ sudo aureport -x --summary
• All failed events: $ sudo aureport --failed
• Files accessed with system calls and usernames (detailed): $ aureport -f -i
• Files accessed with system calls and usernames (summary): $ aureport -f -i --summary
• Searching for an event an pipeing it through aureport: $ ausearch -k test_watch | aureport -f -i

autrace

• Trace a binary for all files and system calls used by it: $ sudo sudo autrace /bin/date. It will give you an event_id number. Then, you can search for it and get a more human-readable report. E.g.: $ sudo ausearch -p 27020 --raw | aureport -f -i

References:

https://www.linux.com/learn/customized-file-monitoring-auditd%20 https://www.linux.com/learn/linux-system-monitoring-and-more-auditd https://www.digitalocean.com/community/tutorials/how-to-use-the-linux-auditing-system-on-centos-7 https://www.digitalocean.com/community/tutorials/how-to-write-custom-system-audit-rules-on-centos-7