<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Hi,<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Please find my response. Sorry for the delay, I am in different Time zone. <o:p></o:p> <o:p> </o:p> <o:p> </o:p> Well, what do you really want to do?<o:p></o:p> <o:p> </o:p> [Tilden] we want to implement audit Logging in Rhel 6.5. for the following events/actions. <o:p></o:p> Login, logout, switch user (su): <o:p></o:p> Rebooting the system, adding and deleting users, changing auditing and logging parameters, changing system clock:(all administrative actions), <o:p></o:p> Process start and stop<o:p></o:p> User executes a command<o:p></o:p> <o:p> </o:p> <o:p> </o:p> In general, I'd look at the original auditing rule to see if its scope can be narrowed. In this case, it appears that you are wanting all calls to chmod. Why?<o:p></o:p> [Tilden] My Audit.rules file for your reference. If possible please suggest me to narrowed down the audit rules for my requirement. <o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> ## First rule - delete all<o:p></o:p> -D<o:p></o:p> <o:p> </o:p> ## Increase the buffers to survive stress events.<o:p></o:p> ## Make this bigger for busy systems<o:p></o:p> -b 8192<o:p></o:p> <o:p> </o:p> ## Set failure mode to panic<o:p></o:p> -f 2<o:p></o:p> <o:p> </o:p> ## Things that could affect time<o:p></o:p> -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change<o:p></o:p> -a always,exit -F arch=b64 -S clock_settime -F a0=0 -k time-change<o:p></o:p> -w /etc/localtime -p wa -k time-change<o:p></o:p> <o:p> </o:p> ## Things that affect identity<o:p></o:p> -w /etc/group -p wa -k identity<o:p></o:p> -w /etc/passwd -p wa -k identity<o:p></o:p> -w /etc/gshadow -p wa -k identity<o:p></o:p> -w /etc/shadow -p wa -k identity<o:p></o:p> -w /etc/security/opasswd -p wa -k identity<o:p></o:p> <o:p> </o:p> ## Things that could affect system locale<o:p></o:p> -a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale<o:p></o:p> -w /etc/issue -p wa -k system-locale<o:p></o:p> -w /etc/issue.net -p wa -k system-locale<o:p></o:p> -w /etc/hosts -p wa -k system-locale<o:p></o:p> -w /etc/sysconfig/network -p wa -k system-locale<o:p></o:p> <o:p> </o:p> ## Things that could affect MAC policy<o:p></o:p> -w /etc/selinux/ -p wa -k MAC-policy<o:p></o:p> <o:p> </o:p> ## - Logon (unsuccessful and successful) and logout (successful)<o:p></o:p> -w /var/log/tallylog -p wa -k logins<o:p></o:p> -w /var/run/faillock/ -p wa -k logins<o:p></o:p> -w /var/log/lastlog -p wa -k logins<o:p></o:p> <o:p> </o:p> ##- Discretionary access control permission modification (unsuccessful<o:p></o:p> ## and successful use of chown/chmod)<o:p></o:p> -a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod<o:p></o:p> -a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod<o:p></o:p> -a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod<o:p></o:p> <o:p> </o:p> ##- Unauthorized access attempts to files (unsuccessful) <o:p> </o:p> -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access<o:p></o:p> -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access<o:p></o:p> <o:p> </o:p> ##- Use of privileged commands (unsuccessful and successful)<o:p></o:p> ## use find /bin -type f -perm -04000 2>/dev/null and put all those files in a rule like this<o:p></o:p> -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged<o:p></o:p> <o:p> </o:p> ##- Export to media (successful)<o:p></o:p> -a always,exit -F arch=b64 -S mount -F auid>=500 -F auid!=4294967295 -k export<o:p></o:p> <o:p> </o:p> ## sudo cannot record the action.<o:p></o:p> -w /etc/sudoers -p wa -k actions<o:p></o:p> <o:p> </o:p> ## Optional - could be an attempt to bypass audit or simply legacy program<o:p></o:p> -a always,exit -F arch=b64 -S personality -F a0!=4294967295 -k bypass<o:p></o:p> <o:p> </o:p> Are you more concerned with failed calls to chmod, meaning a user is trying to change system files?<o:p></o:p> [Tilden] Yes, I am more concern with User level auditing. i.e. what and all actions performed by the user should be logged. we don’t want the System process or any executable to generate logs. <o:p></o:p> <o:p> </o:p> <o:p> </o:p> Are system daemons calling chmod OK? Or do you really want everything?<o:p></o:p> [Tilden] We don’t want the System process / daemons logs <o:p></o:p> <o:p></o:p> Or do you want no events at all for that daemon no matter what the syscall?<o:p></o:p> [Tilden] Yes, we found 3 daemons which is causing the issue of generating lot of logs message, so we want to restrict those daemons from generating log messages, as we want only User level audit logs. <o:p></o:p> <o:p> </o:p> <o:p> </o:p> Thanks<o:p></o:p> Tilden<o:p></o:p> <o:p> </o:p> <o:p> </o:p> -----Original Message----- From: Steve Grubb [mailto:sgrubb@redhat.com] Sent: Monday, November 17, 2014 9:01 PM To: linux-audit@redhat.com Cc: Tilden Doran D Subject: Re: Excluding few executable from audit.rules in redhat6.5 <o:p> </o:p> On Monday, November 17, 2014 03:02:12 PM Tilden Doran D wrote:<o:p></o:p> > I am new to Redhat Audit logging.<o:p></o:p> > Our Server Configurations: Redhat 6.5 OS and Oracle 11g , and <o:p></o:p> > SELinux is enabled.<o:p></o:p> > <o:p></o:p> > We are getting lots of logs messages in /var/log/messages.<o:p></o:p> > <o:p></o:p> > type=SYSCALL msg=audit(1416235337.083:2109222): arch=c000003e <o:p></o:p> > syscall=90 success=yes exit=0 a0=7f52ae9f1a20 a1=3ff <o:p> </o:p> > a2=ffffffffffffff88<o:p></o:p> > a3=fffffffffffffff0 items=1 ppid=1 pid=46859 auid=500 uid=345 gid=345<o:p></o:p> > euid=345 suid=345 fsuid=345 egid=345 sgid=345 fsgid=345 tty=(none) <o:p></o:p> > ses=28 comm="ohasd.bin" exe="/opt/oracle_homes/oracle/grid/11.2.0/bin/ohasd.bin"<o:p></o:p> > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="perm_mod"<o:p></o:p> > type=PATH msg=audit(1416235337.083:2109222): item=0 <o:p> </o:p> > name="/opt/oracle_homes/oracle/grid/11.2.0/auth/ohasd/dl360x3364/A7679703"<o:p></o:p> > inode=4718596 dev=fd:00 mode=041755 ouid=345 ogid=345 rdev=00:00<o:p></o:p> > obj=unconfined_u:object_r:usr_t:s0 nametype=NORMAL<o:p></o:p> > <o:p></o:p> > <o:p></o:p> > Later we found and removed message type "CWD", but still we are <o:p></o:p> > getting lot of logs.<o:p></o:p> > <o:p></o:p> > And also found that the below mentioned executable are creating the problem.<o:p></o:p> > <o:p></o:p> > 13351. 11/16/2014 18:11:34<o:p></o:p> > /opt/oracle_homes/oracle/grid/11.2.0/bin/ohasd.bin (none) ? 500 <o:p></o:p> > 1599360 13352. 11/16/2014 18:11:34 <o:p></o:p> > /opt/oracle_homes/oracle/rdbms/11.2.0/bin/oracle<o:p></o:p> > (none) ? 500 1599354 13353. 11/16/2014 18:11:34 <o:p></o:p> > /opt/oracle_homes/oracle/grid/11.2.0/bin/oraagent.bin (none) ? 500 <o:p></o:p> > 1599361<o:p></o:p> > <o:p></o:p> > Can you please help me in excluding the above mentioned Executable `s <o:p></o:p> > in the audit. rules files .<o:p></o:p> <o:p> </o:p> Well, what do you really want to do? In general, I'd look at the original auditing rule to see if its scope can be narrowed. In this case, it appears that you are wanting all calls to chmod. Why? Are you more concerned with failed calls to chmod, meaning a user is trying to change system files? Are system daemons calling chmod OK? Or do you really want everything? Or do you want no events at all for that daemon no matter what the syscall?<o:p></o:p> <o:p> </o:p> The event you are showing is that app successfully making a directory world writable/readable. Its setting the sticky bit, so its "safe."<o:p></o:p> <o:p> </o:p> -Steve<o:p></o:p> <o:p> </o:p> </div> </body> </html>