![\"command](\"https:\/\/webhostinggeeks.com\/howto\/wp-content\/uploads\/2012\/08\/command-linux-150x150.jpg\" "\\"command")
The audit service is provided for system auditing. Under its default configuration, auditd has modest disk space requirements, and should not noticeably impact system performance. The audit service, configured with at least its default rules, is strongly recommended for all sites, regardless of whether they are running SELinux. In this post, i will share with you the basic steps to install and configure auditd on Linux CentOS 6.3.<\/p>\n
The auditing requirements include :<\/p>\n
a. Ensure Auditing is Configured to Collect Certain System Events
\n\u2013 Information on the Use of Print Command (unsuccessful and successful)
\n\u2013 Startup and Shutdown Events (unsuccessful and successful)<\/p>\n
b. Ensure the auditing software can record the following for each audit event:
\n\u2013 Date and time of the event
\n\u2013 Userid that initiated the event
\n\u2013 Type of event
\n\u2013 Success or failure of the event
\n\u2013 For I&A events, the origin of the request (e.g., terminal ID)
\n\u2013 For events that introduce an object into a user\u2019s address space, and for object deletion events, the name of the object, and in MLS systems, the objects security level.<\/p>\n
c. Ensure files are backed up no less than weekly onto a different system than the system being audited or backup media.<\/p>\n
e. Ensure old logs are closed out and new audit logs are started daily<\/p>\n
f. Ensure the configuration is immutable. With the -e 2 setting a reboot will be required to change any audit rules.<\/p>\n
g. Ensure that the audit data files have permissions of 640, or more restrictive.<\/p>\n
1. To install the auditd service :<\/p>\n
\n[root@centos63 ~]# yum install audit -y\n<\/pre>\n2. To ensure that the auditd service star at boot:<\/p>\n
\n[root@centos63 ~]# chkconfig auditd on\n<\/pre>\nBy default, auditd logs only SELinux denials, which are helpful for debugging SELinux and discovering intrusion attempts, and certain types of security events, such as modifications to user accounts (useradd, passwd, etc), login events, and calls to sudo. Data is stored in \/var\/log\/audit\/audit.log.<\/p>\n
3. Configure the auditd :<\/p>\n
\n[root@centos63 ~]# vim \/etc\/audit\/auditd.conf\n<\/pre>\n\n#\n# This file controls the configuration of the audit daemon\n#\n\nlog_file = \/var\/log\/audit\/audit.log\nlog_format = RAW\nlog_group = root\npriority_boost = 4\nflush = INCREMENTAL\nfreq = 20\nnum_logs = 5\ndisp_qos = lossy\ndispatcher = \/sbin\/audispd\nname_format = NONE\n##name = mydomain\nmax_log_file = 6\nmax_log_file_action = ROTATE\nspace_left = 75\nspace_left_action = SYSLOG\naction_mail_acct = root\nadmin_space_left = 50\nadmin_space_left_action = SUSPEND\ndisk_full_action = SUSPEND\ndisk_error_action = SUSPEND\n##tcp_listen_port =\ntcp_listen_queue = 5\ntcp_max_per_addr = 1\n##tcp_client_ports = 1024-65535\ntcp_client_max_idle = 0\nenable_krb5 = no\nkrb5_principal = auditd\n##krb5_key_file = \/etc\/audit\/audit.key\n<\/pre>\n4. Stop and Start the auditd service :<\/p>\n
\n[root@centos63 ~]# \/etc\/init.d\/auditd stop\nStopping auditd: [ OK ]\n[root@centos63 ~]# \/etc\/init.d\/auditd start\nStarting auditd: [ OK ]\n<\/pre>\n","protected":false},"excerpt":{"rendered":"The audit service is provided for system auditing. Under its default configuration, auditd has modest disk space requirements, and should not noticeably impact system performance. The audit service, configured with…<\/p>\n","protected":false},"author":6,"featured_media":3706,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wds_primary_category":0,"footnotes":""},"categories":[1105],"tags":[1244,1254,1536,1546,1965],"class_list":["post-3838","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audit-log","tag-centos","tag-centos-6-3","tag-linux","tag-linux-utilities","tag-log"],"_links":{"self":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/posts\/3838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/comments?post=3838"}],"version-history":[{"count":0,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/posts\/3838\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/media\/3706"}],"wp:attachment":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/media?parent=3838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/categories?post=3838"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/tags?post=3838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}