An Introduction to the Linux Audit System

To make our start we shall take a look at the Linux Audit System on CentOS 7. This main component of Linux auditing is the auditd and this should be running. The service and the tools we use will be delivered in the form of two packages: audit and audit-libs. These should be installed but we can double check:

$ yum list audit audit-libs
...
Installed Packages
audit.x86_64                               2.7.6-3.el7                 installed
audit-libs.x86_64                          2.7.6-3.el7                 installed
...

We should see output similar to the above extract and that the two packages are installed.

The auditd service should be running so we can write through to the audit.log. We can check the status with the standard systemctl command:

$ sudo systemctl status auditd

We should see the service is active from the output. Again though, we have a dedicated tool for this:

$ sudo auditctl -s
enabled 1
failure 1
pid 435
rate_limit 0
backlog_limit 8192
lost 0
backlog 0
loginuid_immutable 0 unlocked

One of the main things we look for in this output is that it is enabled for autostart. The PID indicates the service is running, mine is 435. This should be a low number, as this is, a much higher number would suggest that it had been restarted after the system boot.

We can search the /var/log/audit/audit.log file using standard tools such as grep but we will find that the dedicated ausearch tool is more useful and powerful.

To list user logins we can run the command

$ sudo ausearch -m USER_LOGIN --start today

The message type that we look for is USER_LOGIN, these  types are always in uppercase. We can limit the search using the –start and –end options. The keyword we use here is today.

We can audit many other items too. Perhaps we want to find out who created a new user account. First we create the user:

$ sudo useradd -m bob

Next, we search the audit to see who created the account. Assuming it is just after 3 in the afternoon we can use a command similar to this:

$ sudo ausearch -m ADD_USER --start 15:00

The output will show the auid being the user account that initiated the user creation. As we used sudo this will be our own account that was used to crreate the new user.

The obvious question now is what are the available message types? Well, we can list them using the following command:

$ ausearch -m help 2>&1 | awk -v RS=' ' '/^[A-Z]{2}/{ print}' | sort
ACCT_LOCK
ACCT_UNLOCK
ADD_GROUP
ADD_USER
ALL
...

The message type of help does not exists so this creates an error and prints all available types. As it is an error we redirect STDERR to STDOUT so we can pipe the command to awk. We set the variable for the Record Seperator to be a space, incoming records and normally delimited by a newline. As all types start with at least two uppercase characters we can remove extraneous lines  by ensuring we only print lines that start those characters.

This concludes are initial look at the Linux Audit System. Now we have the basics we can look more at how we can use this to manage events on our Linux Servers.