auditd – Linux+ Notes & Study

auditd is the userspace component of the Linux Auditing System, responsible for writing audit records to disk. It is part of a larger framework that helps administrators track security-relevant events and monitor system activities by recording them in log files. These logs can be crucial for security auditing, compliance, and forensic investigations.

Key Features:

Real-time Monitoring: auditd allows for real-time tracking of system calls and user activities, providing detailed logs of actions taken on the system.
Configurable Rules: Administrators can set up specific audit rules to monitor particular files, directories, system calls, or user actions.
Security Auditing: auditd helps in meeting security compliance requirements by providing detailed records of system events.
Comprehensive Logging: The logs include a wide range of information, such as file access, user authentication, and changes to system configurations.

Components of the Linux Auditing System:

auditd: The main daemon that collects and writes the audit logs.
auditctl: A command-line tool to manage audit rules that define what events should be logged.
ausearch: A command-line tool to search the audit logs based on various criteria.
aureport: A command-line tool to generate summary reports from the audit logs.
audispd: A daemon that processes audit events in real-time and can send them to other systems or tools.

Configuration Files:

/etc/audit/auditd.conf: The main configuration file for auditd, where you can define settings like the log file location, log rotation behavior, and maximum log file size.
/etc/audit/audit.rules: The file where you define persistent audit rules that should be applied at system startup.

Basic Usage:

Starting and Stopping auditd:

   sudo systemctl start auditd
   sudo systemctl stop auditd
   sudo systemctl restart auditd

Check auditd Status:

   sudo systemctl status auditd

Adding Audit Rules:

To monitor access to a specific file: sudo auditctl -w /etc/passwd -p wa -k passwd_changes
- -w /etc/passwd: Watches the /etc/passwd file.
- -p wa: Logs write (w) and attribute change (a) access.
- -k passwd_changes: Assigns a key for easier searching.
To audit a specific system call, such as chmod:
bash sudo auditctl -a always,exit -F arch=b64 -S chmod -k chmod_changes

Viewing Audit Logs:

Use ausearch to search the logs:
bash sudo ausearch -k passwd_changes
Generate a summary report:
bash sudo aureport -f

Persistent Audit Rules:

To make audit rules persistent across reboots, add them to /etc/audit/rules.d/audit.rules.

Example Workflow:

Suppose you want to monitor changes to the /etc/shadow file, which stores password hashes:

Create an Audit Rule:

   sudo auditctl -w /etc/shadow -p wa -k shadow_changes

Trigger an Event:

Edit the /etc/shadow file (this will trigger the audit rule).

   sudo vim /etc/shadow

View the Logs:

   sudo ausearch -k shadow_changes

Persist the Rule:

Add the rule to /etc/audit/rules.d/audit.rules:
plaintext -w /etc/shadow -p wa -k shadow_changes

Security and Compliance:

Regulatory Compliance: auditd is often used in environments that need to comply with regulatory standards like PCI-DSS, HIPAA, and GDPR, as it provides detailed and tamper-proof logging of system activities.
Security Monitoring: By setting up audit rules, administrators can detect suspicious activity in real time, such as unauthorized access attempts or changes to critical files.

Performance Considerations:

Log Volume: Audit logs can grow quickly, especially on busy systems. It’s important to manage log rotation and retention policies to avoid filling up disk space.
Performance Impact: Extensive audit rules can impose a performance overhead on the system. It’s essential to balance the need for auditing with system performance.

auditd is a powerful tool for enhancing the security and auditability of Linux systems, providing detailed and configurable logging capabilities to track system activities and ensure compliance with security policies.