<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">Steve,</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">Here is the relevant discussion on disabling the tcp listener on Ubuntu.</div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><a href="https://www.redhat.com/archives/linux-audit/2012-September/msg00027.html">https://www.redhat.com/archives/linux-audit/2012-September/msg00027.html</a></font><br></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">I do not know what exactly caused change - but now I think it should be enabled in distributions. </font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">Please let me know.</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">Btw, I got auditd running (by setting LD_LIBRARY_PATH variable) from source now. Still audispd is not started now - what is the way / sequence to start auditd and audispd - if you can point me to some reference or a startup script will help.</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif">Thanks!</font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font color="#20124d" face="verdana, sans-serif"><br></font></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div> <br><div class="gmail_quote">On Wed, Oct 4, 2017 at 12:38 AM, Rituraj Buddhisagar <span dir="ltr"><<a href="mailto:rituraj@vayana.com" target="_blank">rituraj@vayana.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">Sorry if this seems like a spamming, but after I sent the earlier mail - I did install from source successfully with only --prefix=/usr/local </div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">I am now facing issue like the below:</div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;color:rgb(32,18,77)">root@guslogs:/etc/init.d# /usr/local/sbin/auditd </div><div style="font-family:verdana,sans-serif;color:rgb(32,18,77)">/usr/local/sbin/auditd: symbol lookup error: /usr/local/sbin/auditd: undefined symbol: auparse_destroy_ext</div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">If someone can point me to a clean and easy install with dependencies from source it would help. </div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">Steve, please see my previous mail regarding Ubuntu. Thanks a lot for help!</div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_extra"><br clear="all"><div><div class="m_3566209903263874402gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><table cellpadding="0" cellspacing="0" border="0" style="background:none;border-collapse:collapse;color:rgb(85,85,85);font-family:proxima-nova,"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:16px;border:0px;margin:0px;padding:0px"><tbody><tr><td colspan="2" style="font-family:Arial,Helvetica,sans-serif;padding-bottom:5px"><font size="2" color="#0b5394">Best Regards,<br>Rituraj B</font></td></tr><tr><td colspan="2" style="font-family:Arial,Helvetica,sans-serif;color:rgb(38,56,119);font-size:12px"><br></td></tr></tbody></table></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><div><div class="h5"> <br><div class="gmail_quote">On Wed, Oct 4, 2017 at 12:10 AM, Rituraj Buddhisagar <span dir="ltr"><<a href="mailto:rituraj@vayana.com" target="_blank">rituraj@vayana.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">Hi Steve / Audit List ;</div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">I have this issue because Ubuntu has disabled support for listener in their distribution !! </div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">On a blog I found that Debian has not disabled it but the Ubuntu distribution has.</div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">I found this when I ran auditd in foreground with -f option.</div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><div>Listener support is not enabled, ignoring value at line 25</div><div>tcp_listen_queue_parser called with: 5</div><div>Listener support is not enabled, ignoring value at line 26</div><div>tcp_max_per_addr_parser called with: 1</div><div>Listener support is not enabled, ignoring value at line 27</div><div>tcp_listen_queue_parser called with: 1024-65535</div><div>Listener support is not enabled, ignoring value at line 28</div><div>tcp_client_max_idle_parser called with: 0</div><div><br></div></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">Steve, I then went to source site ( <a href="https://people.redhat.com/sgrubb/audit/" target="_blank">https://people.redhat.com/sgru<wbr>bb/audit/</a> ) and downloaded a zip from there.</div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)">I am doing a install using below config command : it fails with python-packages dependency. </div><div><font color="#20124d" face="verdana, sans-serif">./configure --prefix=/usr/local --sbindir=/usr/local/sbin --with-python=yes --with-libwrap --enable-gssapi-krb5=yes --with-libcap-ng=yes</font><br></div><div><font color="#20124d" face="verdana, sans-serif">............</font></div><div><font color="#20124d" face="verdana, sans-serif">.............</font></div><div><font color="#20124d" face="verdana, sans-serif">.............</font></div><div><font color="#20124d" face="verdana, sans-serif"><br></font></div><div><font color="#20124d" face="verdana, sans-serif"><div>checking for python platform... linux2</div><div>checking for python script directory... ${prefix}/lib/python2.7/dist-p<wbr>ackages</div><div>checking for python extension module directory... ${exec_prefix}/lib/python2.7/d<wbr>ist-packages</div><div>configure: error: Python explicitly requested and python headers were not found</div><div>root@guslogs:/usr/src/audit-2.<wbr>7.8# </div><div><br></div><div><br></div><div>Please can you tell me which dependent packages I need to download and configure apart from python? (with a source link would help).</div><div><br></div><div><br></div><div>I see on the site that you have included - "Improved Remote Logging" in the Roadmap :) Appreciate it and anticipating it !</div><div><br></div><div>In the meanwhile I am also thinking of requesting Ubuntu for adding this support - not sure why they did this, what is their logic behind this. I hereby request if you can do something from your end to discuss with Ubuntu maintenars to enable this - as there is a HUGE Linux support base out there using that distro. </div><div><br></div><div>Thanks!</div><div><br></div><div><br></div><div><br></div><div><br></div></font></div><div style="font-family:verdana,sans-serif;font-size:small;color:rgb(32,18,77)"><br></div><div class="gmail_extra"><br clear="all"><div><div class="m_3566209903263874402m_-8181980330549224633gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><table cellpadding="0" cellspacing="0" border="0" style="background:none;border-collapse:collapse;color:rgb(85,85,85);font-family:proxima-nova,"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:16px;border:0px;margin:0px;padding:0px"><tbody><tr><td colspan="2" style="font-family:Arial,Helvetica,sans-serif;padding-bottom:5px"><font size="2" color="#0b5394">Best Regards,<br>Rituraj B</font></td></tr><tr><td colspan="2" style="font-family:Arial,Helvetica,sans-serif;color:rgb(38,56,119);font-size:12px"><br></td></tr></tbody></table></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><div><div class="m_3566209903263874402h5"> <br><div class="gmail_quote">On Tue, Oct 3, 2017 at 8:38 PM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Tuesday, October 3, 2017 8:52:48 AM EDT Rituraj Buddhisagar wrote:<br> > Hi Steve,<br> ><br> > I did check IPtables and I am not having any rules in there. I have allowed<br> > the connections in /etc/hosts.allow. But then I do not see auditd listening<br> > on port 60.<br> > It just shows "ESSTABLISHED" connection on the aggregating server - which<br> > is itself!<br> <br> </span>You should not enable audisp-remote on the aggregating server. Auditd handles<br> incoming connections itself.<br> <span class="m_3566209903263874402m_-8181980330549224633HOEnZb"><font color="#888888"><br> -Steve<br> </font></span><div class="m_3566209903263874402m_-8181980330549224633HOEnZb"><div class="m_3566209903263874402m_-8181980330549224633h5"><br> > root@guslogs:/etc/audit# lsof -i :60<br> > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME<br> > audisp-re 2146 root 3u IPv4 20368 0t0 TCP 192.168.103.7:60-><br> > <a href="http://192.168.103.7:60" rel="noreferrer" target="_blank">192.168.103.7:60</a> (ESTABLISHED)<br> > root@guslogs:/etc/audit#<br> > root@guslogs:/etc/audit# netstat -pan | grep 60<br> > tcp 0 0 <a href="http://0.0.0.0:22" rel="noreferrer" target="_blank">0.0.0.0:22</a> 0.0.0.0:* LISTEN<br> > 1260/sshd<br> > tcp 10491 1360 <a href="http://192.168.103.7:60" rel="noreferrer" target="_blank">192.168.103.7:60</a> <a href="http://192.168.103.7:60" rel="noreferrer" target="_blank">192.168.103.7:60</a><br> > ESTABLISHED 2146/audisp-remote<br> > tcp6 0 0 :::22 :::* LISTEN<br> > 1260/sshd<br> > unix 2 [ ACC ] STREAM LISTENING 16055 1925/0<br> > /tmp/ssh-h0brbTMA4a/agent.1925<br> > unix 3 [ ] STREAM CONNECTED 13777 1260/sshd<br> ><br> > unix 2 [ ] DGRAM 17760 1897/systemd<br> ><br> > unix 3 [ ] STREAM CONNECTED 16036 1897/systemd<br> ><br> > unix 2 [ ] DGRAM 20360 2136/auditd<br> ><br> > unix 3 [ ] STREAM CONNECTED 13260 1/init<br> > /run/systemd/journal/stdout<br> > root@guslogs:/etc/audit#<br> > root@guslogs:/etc/audit# netstat -tanp | grep auditd<br> > root@guslogs:/etc/audit#<br> > root@guslogs:/etc/audit# iptables -L<br> > Chain INPUT (policy ACCEPT)<br> > target prot opt source destination<br> ><br> > Chain FORWARD (policy ACCEPT)<br> > target prot opt source destination<br> ><br> > Chain OUTPUT (policy ACCEPT)<br> > target prot opt source destination<br> > root@guslogs:/etc/audit#<br> > root@guslogs:/etc/audit# cat /etc/hosts.allow<br> > # /etc/hosts.allow: list of hosts that are allowed to access the system.<br> > # See the manual pages hosts_access(5) and<br> > hosts_options(5).<br> > #<br> > # Example: ALL: LOCAL @some_netgroup<br> > # ALL: .<a href="http://foobar.edu" rel="noreferrer" target="_blank">foobar.edu</a> EXCEPT <a href="http://terminalserver.foobar.edu" rel="noreferrer" target="_blank">terminalserver.foobar.edu</a><br> > #<br> > # If you're going to protect the portmapper use the name "rpcbind" for the<br> > # daemon name. See rpcbind(8) and rpc.mountd(8) for further information.<br> > #<br> ><br> > ALL: ALL<br> > root@guslogs:/etc/audit#<br> ><br> ><br> > Best Regards,<br> > Rituraj B<br> ><br> > On Tue, Oct 3, 2017 at 6:14 PM, Steve Grubb <<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>> wrote:<br> > > On Monday, October 2, 2017 11:31:15 PM EDT Rituraj Buddhisagar wrote:<br> > > > P<br> > > > lease see inline-<br> > > ><br> > > > regards<br> > > > <br> > > ><br> > > > On Tue, Oct 3, 2017 at 3:28 AM, Steve Grubb <<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>> wrote:<br> > > > > On Monday, October 2, 2017 2:55:51 PM EDT Rituraj Buddhisagar wrote:<br> > > > > > Hi<br> > > > > ><br> > > > > > I tried my best to configure the audisp-remote.<br> > > > > > I am getting below error on the client machine in /var/log/syslog.<br> > > > > ><br> > > > > > Oct 2 14:41:15 xxxxxx audisp-remote: Error connecting to<br> > ><br> > > <a href="http://192.168.103.7" rel="noreferrer" target="_blank">192.168.103.7</a>:<br> > > > > > Connection refused<br> > > > ><br> > > > > On the server, what do you get for:<br> > > > ><br> > > > > ausearch --start recent -m DAEMON_ACCEPT -i<br> > > > ><br> > > > > The server side records some information about why it did not allow a<br> > > > > connection.<br> > > ><br> > > > I dont see any info in here.<br> > > ><br> > > > # ausearch --start recent -m DAEMON_ACCEPT -i<br> > > > <no matches><br> > ><br> > > Then its not connecting at all. Maybe your firewall is blocking it. Maybe<br> > > selinux is blocking it? Once auditd sees its socket is readable, it calls<br> > > accept(2) and there is no path through the code that doesn't log an event<br> > > with<br> > > a reason. Every possible failure logs a distinct reason why the connection<br> > > failed.<br> > ><br> > > > I tried without --start & -i options as well.<br> > ><br> > > --start today if you didn't connect within 10 minutes of running the<br> > > command.<br> > ><br> > > > But when I do a tcpdump on central server, I do see requests coming in.<br> > ><br> > > (I<br> > ><br> > > > changed port to 60).<br> > > > # tcpdump -i eth1 '( port 60 )'<br> > > > 08:53:56.597946 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq<br> > ><br> > > 4076269451,<br> > ><br> > > > win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7],<br> > > > length 0<br> > > > 08:53:56.597980 IP 192.168.103.7.60 > gusm1.60: Flags [R.], seq 0, ack<br> > > > 4076269452, win 0, length 0<br> > > > 08:53:56.598843 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq<br> > ><br> > > 4076287474,<br> > ><br> > > > win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7],<br> > > > length 0<br> > > > 08:53:56.598858 IP 192.168.103.7.60 > gusm1.60: Flags [R.], seq 0, ack<br> > > > 18024, win 0, length 0<br> > > > 08:53:56.599164 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq<br> > ><br> > > 4076300652,<br> > ><br> > > > win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7],<br> > > > length 0<br> > > > 08:53:56.599175 IP 192.168.103.7.60 > gusm1.60: Flags [R.], seq 0, ack<br> > > > 31202, win 0, length 0<br> > > > 08:53:56.599657 IP gusm1.60 > 192.168.103.7.60: Flags [S], seq<br> > ><br> > > 4076306151,<br> > ><br> > > > win 29200, options [mss 1460,sackOK,TS val 207316 ecr 0,nop,wscale 7],<br> > > > length 0<br> > > ><br> > > > I think the service is only listening locally and not for remote<br> > > > connections?<br> > ><br> > > It opens a socket on all addresses.<br> > > # netstat -tanp | grep auditd<br> > > tcp 0 0 <a href="http://0.0.0.0:60" rel="noreferrer" target="_blank">0.0.0.0:60</a> 0.0.0.0:* LISTEN<br> > > 893/auditd<br> > ><br> > > > root@logs:/etc/audit# lsof -i :60<br> > > > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME<br> > > > audisp-re 1713 root 3u IPv4 17433 0t0 TCP 192.168.103.7:60-><br> > > > <a href="http://192.168.103.7:60" rel="noreferrer" target="_blank">192.168.103.7:60</a> (ESTABLISHED)<br> > > ><br> > > ><br> > > > How do I see that I am using libwrap?<br> > ><br> > > It should have a config line in auditd.conf. If you do not, it defaults to<br> > > yes. That means it looks in /etc/hosts.allow and hosts.deny to decide.<br> > > Odds<br> > > are you put nothing there and the connection proceeds. If I were to guess,<br> > > I'd<br> > > say iptables is blocking your connection.<br> > ><br> > > > I have enable_krb5=no in the<br> > > > auditd.conf on the aggregative server.<br> > ><br> > > Good. Cause doing a krb5 connection without setting that up will cause it<br> > > to<br> > > fail also. I'd bet on iptables being the problem.<br> > ><br> > > -Steve<br> > ><br> > > > > > 192.168.103.7 is the IP address of the central log server.<br> > > > > ><br> > > > > > Notes: My settings are below:<br> > > > > ><br> > > > > > on server as well on client:<br> > > > > > /etc/audisp/audisp-remote<br> > > > > ><br> > > > > > remote_server = 192.168.103.7<br> > > > > > port = 6999<br> > > > > > local_port = 6999<br> > > > > > transport = tcp<br> > > > > > queue_file = /var/spool/audit/remote.log<br> > > > > > mode = immediate<br> > > > > > queue_depth = 2048<br> > > > > > format = ascii<br> > > > > > network_retry_time = 100<br> > > > ><br> > > > > This is probably not your problem but managed is the normal setting<br> > > > > for<br> > > > > format. And do you have enable_krb5 set to no?<br> > > > ><br> > > > > > I have enabled name_format=HOSTNAME only in one place (in<br> > > > > > /etc/audisp/audispd.conf - and not in /etc/audit/auditd.conf<br> > > > > ><br> > > > > > entries in auditd.conf:<br> > > > > ><br> > > > > > rtcp_listen_port = 6999<br> > > > > > tcp_listen_queue = 5<br> > > > > > tcp_max_per_addr = 10<br> > > > > > tcp_client_ports = 0-65535<br> > > > > > tcp_client_max_idle = 0<br> > > > ><br> > > > > What do you have for use_libwrap and enable_krb5?<br> > > > ><br> > > > > The ausearcn info from the aggregating server should tell the reason<br> > ><br> > > why<br> > ><br> > > > > the<br> > > > > connection is rejected.<br> > > > ><br> > > > > -Steve<br> > > > ><br> > > > > > I see the server is listening on the port 6999 as below but its not<br> > > > > > accepting client request.<br> > > > > > root@logs:/etc# lsof -i :6999<br> > > > > > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME<br> > > > > > audisp-re 9091 root 3u IPv4 33671 0t0 TCP<br> > ><br> > > <a href="http://192.168.103.7:6999" rel="noreferrer" target="_blank">192.168.103.7:6999</a><br> > ><br> > > > > -><br> > > > ><br> > > > > > <a href="http://192.168.103.7:6999" rel="noreferrer" target="_blank">192.168.103.7:6999</a> (ESTABLISHED)<br> > > > > ><br> > > > > ><br> > > > > ><br> > > > > > Best Regards,<br> > > > > > Rituraj B<br> <br> <br> </div></div></blockquote></div><br></div></div></div></div> </blockquote></div><br></div></div></div></div> </blockquote></div><br></div></div>