<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">Steve, I should have attached my config in previous mail:</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">Here is the config on the aggregating server. (I see tcp_listen_port in auditd.conf and then there is mention of local port & port in audisp-remote.conf as well)</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">I do not see auditd listening on port 60 as per my previous mail. (netstat output)</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# cat auditd.conf </font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">#</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"># This file controls the configuration of the audit daemon</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">#</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">log_file = /var/log/audit/audit.log</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">log_format = RAW</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">log_group = root</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">priority_boost = 4</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">flush = INCREMENTAL</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">freq = 20</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">num_logs = 5</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">disp_qos = lossy</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">dispatcher = /sbin/audispd</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">name_format = NONE</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">##name = mydomain</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">max_log_file = 6 </font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">max_log_file_action = ROTATE</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">space_left = 75</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">space_left_action = SYSLOG</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">action_mail_acct = root</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">admin_space_left = 50</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">admin_space_left_action = SUSPEND</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">disk_full_action = SUSPEND</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">disk_error_action = SUSPEND</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">tcp_listen_port = 60</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">tcp_listen_queue = 5</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">tcp_max_per_addr = 10</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">tcp_client_ports = 0-65535</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">tcp_client_max_idle = 0</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">enable_krb5 = no</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">krb5_principal = auditd</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">use_libwrap = no</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">##krb5_key_file = /etc/audit/audit.key</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# cat ../audisp/audisp-remote.conf </font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">#</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"># This file controls the configuration of the audit remote </font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"># logging subsystem, audisp-remote.</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">#</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">remote_server = 192.168.103.7</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">port = 60</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">local_port = 60</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">transport = tcp</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">queue_file = /var/spool/audit/remote.log</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">mode = immediate</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">queue_depth = 2048</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">format = ascii</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">network_retry_time = 100</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">max_tries_per_record = 3</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">max_time_per_record = 5</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">heartbeat_timeout = 0 </font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">network_failure_action = stop</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">disk_low_action = ignore</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">disk_full_action = ignore</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">disk_error_action = syslog</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">remote_ending_action = reconnect</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">generic_error_action = syslog</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">generic_warning_action = syslog</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">overflow_action = syslog</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">##enable_krb5 = no</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">##krb5_principal = </font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">##krb5_client_name = auditd</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">##krb5_key_file = /etc/audisp/audisp-remote.key</font></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"> </div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><table cellpadding="0" cellspacing="0" border="0" style="background:none;border-collapse:collapse;color:rgb(85,85,85);font-family:proxima-nova,"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:16px;border:0px;margin:0px;padding:0px"><tbody><tr><td colspan="2" style="font-family:Arial,Helvetica,sans-serif;padding-bottom:5px"><font size="2" color="#0b5394">Best Regards,<br>Rituraj B</font></td></tr><tr><td colspan="2" style="font-family:Arial,Helvetica,sans-serif;color:rgb(38,56,119);font-size:12px"><br></td></tr></tbody></table></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div> <br><div class="gmail_quote">On Tue, Oct 3, 2017 at 6:22 PM, Rituraj Buddhisagar <span dir="ltr"><<a href="mailto:rituraj@vayana.com" target="_blank">rituraj@vayana.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">Hi Steve, </div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">I did check IPtables and I am not having any rules in there. I have allowed the connections in /etc/hosts.allow. But then I do not see auditd listening on port 60.</div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">It just shows "ESSTABLISHED" connection on the aggregating server - which is itself!</div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div><div><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# lsof -i :60</font></div><span class=""><div><font color="#20124d" face="verdana, sans-serif">COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME</font></div></span><div><span style="color:rgb(32,18,77);font-family:verdana,sans-serif">audisp-re 2146 root 3u IPv4 20368 0t0 TCP 192.168.103.7:60-><a href="http://192.168.103.7:60" target="_blank">192.168.103.<wbr>7:60</a> (ESTABLISHED)</span><br></div><div><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# </font></div><div style="color:rgb(32,18,77);font-family:verdana,sans-serif;font-size:small">root@guslogs:/etc/audit# netstat -pan | grep 60<br></div></div><div><div><font color="#20124d" face="verdana, sans-serif">tcp 0 0 <a href="http://0.0.0.0:22" target="_blank">0.0.0.0:22</a> 0.0.0.0:* LISTEN 1260/sshd </font></div><div><font color="#20124d" face="verdana, sans-serif">tcp 10491 1360 <a href="http://192.168.103.7:60" target="_blank">192.168.103.7:60</a> <a href="http://192.168.103.7:60" target="_blank">192.168.103.7:60</a> ESTABLISHED 2146/audisp-remote</font></div><div><font color="#20124d" face="verdana, sans-serif">tcp6 0 0 :::22 :::* LISTEN 1260/sshd </font></div><div><font color="#20124d" face="verdana, sans-serif">unix 2 [ ACC ] STREAM LISTENING 16055 1925/0 /tmp/ssh-h0brbTMA4a/agent.<wbr>1925</font></div><div><font color="#20124d" face="verdana, sans-serif">unix 3 [ ] STREAM CONNECTED 13777 1260/sshd </font></div><div><font color="#20124d" face="verdana, sans-serif">unix 2 [ ] DGRAM 17760 1897/systemd </font></div><div><font color="#20124d" face="verdana, sans-serif">unix 3 [ ] STREAM CONNECTED 16036 1897/systemd </font></div><div><font color="#20124d" face="verdana, sans-serif">unix 2 [ ] DGRAM 20360 2136/auditd </font></div><div><font color="#20124d" face="verdana, sans-serif">unix 3 [ ] STREAM CONNECTED 13260 1/init /run/systemd/journal/stdout</font></div><div><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# </font></div><div><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# netstat -tanp | grep auditd</font></div><div><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# </font></div><div><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# iptables -L</font></div><div><font color="#20124d" face="verdana, sans-serif">Chain INPUT (policy ACCEPT)</font></div><div><font color="#20124d" face="verdana, sans-serif">target prot opt source destination </font></div><div><font color="#20124d" face="verdana, sans-serif"><br></font></div><div><font color="#20124d" face="verdana, sans-serif">Chain FORWARD (policy ACCEPT)</font></div><div><font color="#20124d" face="verdana, sans-serif">target prot opt source destination </font></div><div><font color="#20124d" face="verdana, sans-serif"><br></font></div><div><font color="#20124d" face="verdana, sans-serif">Chain OUTPUT (policy ACCEPT)</font></div><div><font color="#20124d" face="verdana, sans-serif">target prot opt source destination </font></div><div><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# </font></div><div><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# cat /etc/hosts.allow </font></div><div><font color="#20124d" face="verdana, sans-serif"># /etc/hosts.allow: list of hosts that are allowed to access the system.</font></div><div><font color="#20124d" face="verdana, sans-serif"># See the manual pages hosts_access(5) and hosts_options(5).</font></div><div><font color="#20124d" face="verdana, sans-serif">#</font></div><div><font color="#20124d" face="verdana, sans-serif"># Example: ALL: LOCAL @some_netgroup</font></div><div><font color="#20124d" face="verdana, sans-serif"># ALL: .<a href="http://foobar.edu" target="_blank">foobar.edu</a> EXCEPT <a href="http://terminalserver.foobar.edu" target="_blank">terminalserver.foobar.edu</a></font></div><div><font color="#20124d" face="verdana, sans-serif">#</font></div><div><font color="#20124d" face="verdana, sans-serif"># If you're going to protect the portmapper use the name "rpcbind" for the</font></div><div><font color="#20124d" face="verdana, sans-serif"># daemon name. See rpcbind(8) and rpc.mountd(8) for further information.</font></div><div><font color="#20124d" face="verdana, sans-serif">#</font></div><div><font color="#20124d" face="verdana, sans-serif"><br></font></div><div><font color="#20124d" face="verdana, sans-serif">ALL: ALL</font></div><div><font color="#20124d" face="verdana, sans-serif">root@guslogs:/etc/audit# </font></div><div style="color:rgb(32,18,77);font-family:verdana,sans-serif;font-size:small"><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="m_-3606065374006616262gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><table cellpadding="0" cellspacing="0" border="0" style="background:none;border-collapse:collapse;color:rgb(85,85,85);font-family:proxima-nova,"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:16px;border:0px;margin:0px;padding:0px"><tbody><tr><td colspan="2" style="font-family:Arial,Helvetica,sans-serif;padding-bottom:5px"><font size="2" color="#0b5394">Best Regards,<br>Rituraj B</font></td></tr><tr><td colspan="2" style="font-family:Arial,Helvetica,sans-serif;color:rgb(38,56,119);font-size:12px"><br></td></tr></tbody></table></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><div><div class="h5"> <br><div class="gmail_quote">On Tue, Oct 3, 2017 at 6:14 PM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Monday, October 2, 2017 11:31:15 PM EDT Rituraj Buddhisagar wrote:<br> > P<br> > lease see inline-<br> ><br> > regards<br> > <br> ><br> > On Tue, Oct 3, 2017 at 3:28 AM, Steve Grubb <<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>> wrote:<br> > > On Monday, October 2, 2017 2:55:51 PM EDT Rituraj Buddhisagar wrote:<br> > > > Hi<br> > > ><br> > > > I tried my best to configure the audisp-remote.<br> > > > I am getting below error on the client machine in /var/log/syslog.<br> > > ><br> > > > Oct 2 14:41:15 xxxxxx audisp-remote: Error connecting to <a href="http://192.168.103.7" rel="noreferrer" target="_blank">192.168.103.7</a>:<br> > > > Connection refused<br> > ><br> > > On the server, what do you get for:<br> > ><br> > > ausearch --start recent -m DAEMON_ACCEPT -i<br> > ><br> > > The server side records some information about why it did not allow a<br> > > connection.<br> ><br> > I dont see any info in here.<br> ><br> > # ausearch --start recent -m DAEMON_ACCEPT -i<br> > <no matches><br> <br> </span>Then its not connecting at all. Maybe your firewall is blocking it. Maybe<br> selinux is blocking it? Once auditd sees its socket is readable, it calls<br> accept(2) and there is no path through the code that doesn't log an event with<br> a reason. Every possible failure logs a distinct reason why the connection<br> failed.<br> <span><br> <br> > I tried without --start & -i options as well.<br> <br> </span>--start today if you didn't connect within 10 minutes of running the command.<br> <span><br> <br> > But when I do a tcpdump on central server, I do see requests coming in. (I<br> > changed port to 60).<br> > # tcpdump -i eth1 '( port 60 )'<br> > 08:53:56.597946 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq 4076269451,<br> > win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7],<br> > length 0<br> > 08:53:56.597980 IP 192.168.103.7.60 > gusm1.60: Flags [R.], seq 0, ack<br> > 4076269452, win 0, length 0<br> > 08:53:56.598843 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq 4076287474,<br> > win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7],<br> > length 0<br> > 08:53:56.598858 IP 192.168.103.7.60 > gusm1.60: Flags [R.], seq 0, ack<br> > 18024, win 0, length 0<br> > 08:53:56.599164 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq 4076300652,<br> > win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7],<br> > length 0<br> > 08:53:56.599175 IP 192.168.103.7.60 > gusm1.60: Flags [R.], seq 0, ack<br> > 31202, win 0, length 0<br> > 08:53:56.599657 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq 4076306151,<br> > win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7],<br> > length 0<br> ><br> > I think the service is only listening locally and not for remote<br> > connections?<br> <br> </span>It opens a socket on all addresses.<br> # netstat -tanp | grep auditd<br> tcp 0 0 <a href="http://0.0.0.0:60" rel="noreferrer" target="_blank">0.0.0.0:60</a> 0.0.0.0:* LISTEN<br> 893/auditd<br> <span><br> > root@logs:/etc/audit# lsof -i :60<br> > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME<br> > audisp-re 1713 root 3u IPv4 17433 0t0 TCP 192.168.103.7:60-><br> > <a href="http://192.168.103.7:60" rel="noreferrer" target="_blank">192.168.103.7:60</a> (ESTABLISHED)<br> ><br> ><br> > How do I see that I am using libwrap?<br> <br> </span>It should have a config line in auditd.conf. If you do not, it defaults to<br> yes. That means it looks in /etc/hosts.allow and hosts.deny to decide. Odds<br> are you put nothing there and the connection proceeds. If I were to guess, I'd<br> say iptables is blocking your connection.<br> <span><br> > I have enable_krb5=no in the<br> > auditd.conf on the aggregative server.<br> <br> </span>Good. Cause doing a krb5 connection without setting that up will cause it to<br> fail also. I'd bet on iptables being the problem.<br> <span class="m_-3606065374006616262HOEnZb"><font color="#888888"><br> -Steve<br> </font></span><div class="m_-3606065374006616262HOEnZb"><div class="m_-3606065374006616262h5"><br> <br> > > > 192.168.103.7 is the IP address of the central log server.<br> > > ><br> > > > Notes: My settings are below:<br> > > ><br> > > > on server as well on client:<br> > > > /etc/audisp/audisp-remote<br> > > ><br> > > > remote_server = 192.168.103.7<br> > > > port = 6999<br> > > > local_port = 6999<br> > > > transport = tcp<br> > > > queue_file = /var/spool/audit/remote.log<br> > > > mode = immediate<br> > > > queue_depth = 2048<br> > > > format = ascii<br> > > > network_retry_time = 100<br> > ><br> > > This is probably not your problem but managed is the normal setting for<br> > > format. And do you have enable_krb5 set to no?<br> > ><br> > > > I have enabled name_format=HOSTNAME only in one place (in<br> > > > /etc/audisp/audispd.conf - and not in /etc/audit/auditd.conf<br> > > ><br> > > > entries in auditd.conf:<br> > > ><br> > > > rtcp_listen_port = 6999<br> > > > tcp_listen_queue = 5<br> > > > tcp_max_per_addr = 10<br> > > > tcp_client_ports = 0-65535<br> > > > tcp_client_max_idle = 0<br> > ><br> > > What do you have for use_libwrap and enable_krb5?<br> > ><br> > > The ausearcn info from the aggregating server should tell the reason why<br> > > the<br> > > connection is rejected.<br> > ><br> > > -Steve<br> > ><br> > > > I see the server is listening on the port 6999 as below but its not<br> > > > accepting client request.<br> > > > root@logs:/etc# lsof -i :6999<br> > > > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME<br> > > > audisp-re 9091 root 3u IPv4 33671 0t0 TCP <a href="http://192.168.103.7:6999" rel="noreferrer" target="_blank">192.168.103.7:6999</a><br> > ><br> > > -><br> > ><br> > > > <a href="http://192.168.103.7:6999" rel="noreferrer" target="_blank">192.168.103.7:6999</a> (ESTABLISHED)<br> > > ><br> > > ><br> > > ><br> > > > Best Regards,<br> > > > Rituraj B<br> <br> <br> </div></div></blockquote></div><br></div></div></div></div> </blockquote></div><br></div></div>