audisp-prelude problems

[Steve Grubb]

On Wednesday 03 December 2008 05:23:28 Loredan Stancu wrote:
> I'm testing version 1.7.9 of audit using audisp-prelude plugin and I have
> some problems:

Might also be helpful to know which distribution and release, IOW Fedora 10?


> 1. audisp-prelude plugin is not generating events when a user is logged in.

Do you find USER_LOGIN events? ausearch --start today -m USER_LOGIN
Without that, you won't see anything.


> 2. audisp-prelude plugin is not sending uid, gid to a prelude-manager

For which event? The loginuid is mostly what I concentrated on since that 
tells you how they got into the machine.


> 3. No events are generate for watched files/exec/mk_exe  if no tow -k
> options are specified in the rule. One of the -k options should contain
> '-k ids-type-severity' and another -k may contain anything. If you specify
> only one -k options no events are generated.

You need 2 rules to cover this:

auditctl -a exit,always -S fchmodat -F dir=/home -F 'a2&0111' -F filetype=file 
  -k ids-mkexe-hi
auditctl -a exit,always -S fchmod,chmod -F dir=/home -F 'a1&0111' 
  -F filetype=file -k ids-mkexe-hi

It works fine on my system. Also note that it depends on having a recent 
kernel.


> Another question is how I can use audisp-remote to send events somewhere
> remote?

Assuming you are using Fedora, to set this up on client machines, you will 
need to install the audispd-plugins package. Then you need to set the 
remote_server and port in the /etc/audisp/audisp-remote.conf file. 

The server that aggregates the logs does not need the plugins package 
installed. It should have the tcp_listen_port set to the same port as the 
clients in the  /etc/audit/auditd.conf file. Then semanage needs to have the 
same port in its database since the audit daemon is protected by SE Linux. 
Assuming that you wanted the audit daemon listening on port 1000, you would 
run:

semanage port -a -t audit_port_t -p tcp 1000.

The last step is to edit the /etc/hosts.allow file to configure tcp_wrappers to 
allow the machines or subnets that the daemon should allow connections from.

-Steve