Auditing TCP connections
Steve Grubb
sgrubb at redhat.com
Wed Dec 9 18:27:16 UTC 2009
On Tuesday 08 December 2009 11:21:14 pm Data Lineage wrote:
> Is my understanding correct that the Linux Audit framework currently
> only logs the remote endpoint of TCP connections?
It records what is passed to the connect syscall or what accept is seeing.
> That is, when a connect() call occurs, only the remote IP and port are
> logged, not the local ones?
That is probably correct. I don't recall seeing duplicate network records
> If so, would it be possible to add the local end point into the audit
> trail?
I'm pretty sure it could be patched to provide that if its not. I think we
might want a new record type or some way of distinguishing which record is
local and remote.
I have been reading through the new OSPP from NIAP and it calls out for
selective audit based on network address, too. So, it would kind of fit with
what will be required going forward.
So...were you planning to send a patch or is this a request for us to write
one?
-Steve
More information about the Linux-audit
mailing list