{"id":21077,"date":"2024-03-28T06:09:18","date_gmt":"2024-03-28T06:09:18","guid":{"rendered":"https:\/\/www.insentragroup.com\/au\/insights\/uncategorized\/mastering-auditd-in-rhel-ensuring-security-through-auditing\/"},"modified":"2024-12-13T02:22:24","modified_gmt":"2024-12-13T02:22:24","slug":"mastering-auditd-in-rhel-ensuring-security-through-auditing","status":"publish","type":"post","link":"https:\/\/www.insentragroup.com\/au\/insights\/geek-speak\/modern-workplace\/mastering-auditd-in-rhel-ensuring-security-through-auditing\/","title":{"rendered":"Mastering auditd in RHEL: Ensuring Security Through Auditing\u00a0"},"content":{"rendered":"\n<p>In the world of Red Hat Enterprise Linux (RHEL), securing your systems against unauthorised access and ensuring compliance with security policies are key priorities. One of the most powerful tools at your disposal for this task is auditd, the Linux Auditing System&#8217;s user-space component.&nbsp;<\/p>\n\n\n\n<p>This technical blog dives into what auditd is, its uses, benefits, the structure of its rules and how you can deploy it to detect unauthorised access and other security-relevant events.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is auditd?<\/h2>\n\n\n\n<p>auditd is a key part of the Linux Auditing System, designed to monitor and record system activities based on rules defined by the system administrator. It captures detailed information about security-relevant events, logging them for later analysis. This can range from system startup and shutdown to file access, network events and even security breach attempts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to use auditd<\/h2>\n\n\n\n<p>Organisations can use auditd in several ways. Here are some of them:&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"1\">\n<li><strong>Security Monitoring and Compliance<\/strong>&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>Auditd is instrumental in security monitoring and compliance. It helps in tracking any changes or attempts to change sensitive parts of the system, ensuring that any unauthorised access attempts are logged and can be investigated.&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li><strong>Intrusion Detection<\/strong>&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>By monitoring system calls and file accesses, auditd can act as a basic form of intrusion detection, alerting administrators to potentially malicious activities.&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\">\n<li><strong>Forensic Analysis<\/strong>&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>In the event of a security breach, the detailed logs provided by auditd can be crucial in forensic analysis, helping you understand how the breach occurred and how to prevent future occurrences.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Benefits of Using auditd<\/h2>\n\n\n\n<p>auditd offers many benefits to system administrators. Below are only a few of them:&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"1\">\n<li><strong>Comprehensive Logging<\/strong>: auditd provides detailed information about every tracked event, including the time, type of event and the user involved<\/li>\n\n\n\n<li><strong>Customisation Rules<\/strong>: Administrators can define specific rules that tailor the logging to their security needs<\/li>\n\n\n\n<li><strong>Security and Compliance<\/strong>: auditd helps in maintaining compliance with security policies and regulatory requirements by providing a detailed auditd trail&nbsp;<\/li>\n\n\n\n<li><strong>Forensics<\/strong>: The detailed logs serve as a valuable resource for forensic analysis after a security incident<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Structure of auditd Rules<\/h2>\n\n\n\n<p>auditd rules can be broadly categorised into control rules, file system rules and system call rules. These categories define what activities to log and how to log them. Here\u2019s a brief overview:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control Rules: <\/strong>These rules manage how the audit system operates, setting parameters like the maximum number of active rules or how long logs are kept&nbsp;<\/li>\n\n\n\n<li><strong>File System Rules:<\/strong> These specify monitoring of access to certain files or directories&nbsp;<\/li>\n\n\n\n<li><strong>System Call Rules:<\/strong> Used to track the use of system calls by users or processes&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Rules can be added to \/etc\/audit\/rules.d\/audit.rules or directly via the <strong>auditctl<\/strong> command.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Examples of auditd Rules<\/h2>\n\n\n\n<p>If you\u2019re still uncertain of how you can execute auditd, check out these examples below.&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"1\">\n<li><strong>Monitoring File Access<\/strong>&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>To monitor all access to \/etc\/passwd, you could use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-w \/etc\/passwd -p warx -k passwd_changes <\/code><\/pre>\n\n\n\n<p>&nbsp;This rule watches (-w) the \/etc\/passwd file for write (w), attribute change (a), read (r), and execute (x) operations, tagging entries with passwd_changes for easy filtering.<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li><strong>Tracking Login and Logout Events<\/strong><\/li>\n<\/ol>\n\n\n\n<p>To track user login\/logout events:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale <\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Deploying auditd to Detect Unauthorised Access<\/h2>\n\n\n\n<p>To effectively use auditd for detecting unauthorised access, consider the following strategies:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Monitor sensitive files by creating rules to track access to confidential files and directories&nbsp;<\/li>\n\n\n\n<li>Track privileged commands using system call rules to log the execution of privileged commands&nbsp;<\/li>\n\n\n\n<li>Auditd logins and logouts by keeping track of user logins, logouts and session management to detect unauthorised access attempts&nbsp;<\/li>\n\n\n\n<li>Regularly review auditd logs, looking for anomalies or unauthorised access attempts<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">auditd: Beyond Basic Configuration<\/h2>\n\n\n\n<p>While auditd is instrumental in monitoring system activities under normal circumstances, its significance is magnified on a CIS-hardened RHEL system. Here, auditd can be configured to specifically monitor for changes or attempts to change security settings and compliance with CIS benchmarks.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Areas for auditd Monitoring on a CIS-Hardened System<\/h2>\n\n\n\n<ol class=\"wp-block-list\" start=\"1\">\n<li><strong>User and Group Management<\/strong>&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>CIS benchmarks recommend strict policies on user creation, management and privileges. auditd can monitor relevant system calls to these activities, such as useradd, groupadd and any changes to \/etc\/passwd, \/etc\/shadow or \/etc\/group.&nbsp;<\/p>\n\n\n\n<p>Example Rule:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-w \/etc\/passwd -p wa -k user_changes \n<br>\n-w \/etc\/shadow -p wa -k password_changes \n<br>\n-w \/etc\/group -p wa -k group_changes \n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li><strong>File and Directory Permissions<\/strong>&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>CIS guidelines specify secure default permissions for files and directories. auditd can help ensure these permissions aren\u2019t improperly modified.&nbsp;<\/p>\n\n\n\n<p>Example Rule:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-w \/etc\/ssh\/sshd_config -p wa -k ssh_config_changes <\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\">\n<li><strong>System and Network Configuration<\/strong>&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>Monitoring changes to system and network configurations is vital. This includes tracking modifications to firewall settings or network service configurations.&nbsp;<\/p>\n\n\n\n<p>Example Rule:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-a always,exit -F arch=b64 -S setsockopt,setsockcreate -k network_changes <\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"4\">\n<li><strong>Authentication and Authorisation Mechanisms<\/strong>&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>With CIS benchmarks, mechanisms like SELinux, sudo configurations and PAM are tightly controlled. You can craft auditd rules to monitor any alterations to these configurations.&nbsp;<\/p>\n\n\n\n<p>Example Rule:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-w \/etc\/sudoers -p wa -k sudoers_change \n<br>\n-w \/etc\/selinux\/ -p wa -k selinux_change \n<br>\n-w \/etc\/pam.d\/ -p wa -k pam_change <\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"5\">\n<li><strong>Logging and Auditing Configurations<\/strong>&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>It\u2019s crucial to ensure that auditing itself is not tampered with to maintain system security. Monitoring changes to auditd configurations and log files is a must.&nbsp;<\/p>\n\n\n\n<p>Example Rule:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-w \/etc\/audit\/ -p wa -k audit_config_change \n<br>\n-w \/var\/log\/ -p wa -k log_access <\/code><\/pre>\n\n\n\n<p><strong>Implementing Auditd in a CIS-Hardened Environment<\/strong>&nbsp;<\/p>\n\n\n\n<p>To effectively implement auditd monitoring on a CIS-hardened RHEL system, administrators should:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Understand the specific recommendations for RHEL and identify key areas for monitoring&nbsp;<\/li>\n\n\n\n<li>Tailor auditd rules to closely monitor compliance with CIS recommendations, focusing on critical areas like user management, file permissions and system configurations&nbsp;<\/li>\n\n\n\n<li>Regularly review auditd logs for anomalies or non-compliance with CIS benchmarks. Automated tools and scripts can assist in highlighting discrepancies. Use external logging systems to aggregate the logs from multiple systems and analyse the logs to find patterns&nbsp;<\/li>\n\n\n\n<li>As CIS benchmarks evolve, update your auditd rules to cover new or updated recommendations&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>We hope this guide helped you understand how auditd works and how it can help you strengthen system security. If you need guidance on executing auditd, Insentra is here to assist you. <a href=\"https:\/\/www.insentragroup.com\/au\/contact\/\" target=\"_blank\" rel=\"noreferrer noopener\">Contact us<\/a> today to start a conversation on how we can improve your security posture.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>auditd is a critical tool for Red Hat Enterprise Linux (RHEL) users. Read this blog to learn how auditd helps you strengthen your security and avoid breaches. <\/p>\n","protected":false},"author":67,"featured_media":21078,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-21077","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-modern-workplace","entry"],"_links":{"self":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts\/21077","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/users\/67"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/comments?post=21077"}],"version-history":[{"count":1,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts\/21077\/revisions"}],"predecessor-version":[{"id":21079,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts\/21077\/revisions\/21079"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/media\/21078"}],"wp:attachment":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/media?parent=21077"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/categories?post=21077"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/tags?post=21077"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}