Red Hat Security: Linux in Physical, Virtual, and Cloud

Verify that Audit is installed and running on servera.

1. Log in to servera as student. No password is required.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 

2. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

3. Verify that the auditd service is running and enabled.

   [root@servera ~]# systemctl status auditd
   ...output omitted...
      Active: active (running) since Thu 2018-07-19 05:13:46 EDT; 28min ago
   ...output omitted...
   [root@servera ~]# systemctl is-enabled auditd
   enabled

4. Verify that the /var/log/audit/audit.log log file records the start of the previous root session with sudo.

   [root@servera ~]# tail /var/log/audit/audit.log
   ...output omitted...
   type=USER_START msg=audit(1531994484.712:334): pid=1489 uid=0 auid=1000 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
   ...output omitted...

   This records the successful start of a user session as root, using sudo on terminal pts/1. The user running the command first logged in today as UID 1000. The event happened at epoch time 1531994484.712 (seconds after 00:00 UTC on January 1, 1970). Some of these details will be different for your audit event.

Verify the values for the flush and freq variables in the Audit configuration file to tune the performance for Audit. Modify the values for the log_format and the name_format variables to include additional information in the Audit log file.

1. In the /etc/audit/auditd.conf configuration file, verify that the value for the flush option is INCREMENTAL_ASYNC to flush audit events asynchronously, and the value for the freq variable is 50 to flush the Audit log after every 50 records.

   Set the value for the log_format variable to ENRICHED to include in the Audit log file additional information.

   Finally, configure the name_format variable to HOSTNAME to include the host name in the Audit log file.

   [root@servera ~]# vi /etc/audit/auditd.conf
   ...output omitted...
   log_format = ENRICHED
   flush = INCREMENTAL_ASYNC
   freq = 50
   name_format = HOSTNAME
   ...output omitted...

2. Restart the auditd service to update its configuration.

   [root@servera ~]# service auditd restart

Configure the Audit service on servera to send audit messages to the Audit service on serverb.

1. Install the audispd-plugins package.

   [root@servera ~]# yum install audispd-plugins

2. In the /etc/audisp/plugins.d/au-remote.conf file, set the value for the active option to yes to enable remote logging.

   [root@servera ~]# vi /etc/audisp/plugins.d/au-remote.conf
   ...output omitted...
   active = yes
   ...output omitted...

3. In the /etc/audisp/audisp-remote.conf file, set the remote_server option to the IP address of the remote logging server in our environment, serverb.lab.example.com. Set the port to be used on the remote logging server, which is 60 by default.

   [root@servera ~]# vi /etc/audisp/audisp-remote.conf
   ...output omitted...
   remote_server = 172.25.250.11
   port = 60
   ...output omitted...

4. Restart the auditd service to update its configuration. When done, log off from servera.

   [root@servera ~]# service auditd restart
   [root@servera ~]# logout
   [student@servera ~]$ logout
   [student@workstation ~]$ 

Configure the Audit service on serverb to accept audit messages.

1. Log in to serverb as student from the student account on workstation. SSH public key authentication should be configured for you, so you do not need to enter a password.

   [student@workstation ~]$ ssh student@serverb
   [student@serverb ~]$ 

2. Use the sudo -i command to switch to the root user. Use student as the password.

   [student@serverb ~]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]# 

3. In the /etc/audit/auditd.conf file, uncomment the tcp_listen_port variable and set its value to 60 so that the Audit service listens TCP port 60.

   [root@serverb ~]# vi /etc/audit/auditd.conf
   ...output omitted...
   tcp_listen_port = 60
   ...output omitted...

4. Open TCP port 60 to enable access to the Audit server.

   [root@serverb ~]# firewall-cmd --zone=public --add-port=60/tcp \
   > --permanent
   success
   [root@serverb ~]# firewall-cmd --reload
   success

5. Restart the auditd service to update its configuration. When done, log off from serverb.

   [root@serverb ~]# service auditd restart
   [root@serverb ~]# logout
   [student@serverb ~]$ logout
   [student@workstation ~]$ 

Verify that remote logging for Audit is working.

1. Log in to servera as student. No password is required.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 

2. Use the sudo -i command to switch identity to the root user. Use student as the password. When done, log off from servera.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# logout
   [student@servera ~]$ logout
   [student@workstation ~]$ 

3. Log in to serverb as student. No password is required.

   [student@workstation ~]$ ssh student@serverb
   [student@serverb ~]$ 

4. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverb ~]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]# 

5. Verify that new entries in the Audit log file exist for the message created on servera. When done, log off from serverb.

   [root@serverb ~]# grep servera /var/log/audit/audit.log
   ...output omitted...
   node=servera.lab.example.com type=CRYPTO_KEY_USER msg=audit(1532102732.526:419): pid=2378 uid=0 auid=0 ses=28 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:67:d3:(...):87:9f direction=? spid=2378 suid=0  exe="/usr/sbin/sshd" hostname=servera.lab.example.com addr=? terminal=pts/1 res=success' UID="root" AUID="root" SUID="root"
   node=servera.lab.example.com type=CRYPTO_KEY_USER msg=audit(1532102732.526:420): pid=2378 uid=0 auid=0 ses=28 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:04:c7:(...):1d:12 direction=? spid=2378 suid=0  exe="/usr/sbin/sshd" hostname=servera.lab.example.com addr=? terminal=pts/1 res=success' UID="root" AUID="root" SUID="root"
   node=servera.lab.example.com type=CRYPTO_KEY_USER msg=audit(1532102732.526:421): pid=2378 uid=0 auid=0 ses=28 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:f6:bd:(...):12:82 direction=? spid=2378 suid=0  exe="/usr/sbin/sshd" hostname=servera.lab.example.com addr=? terminal=pts/1 res=success' UID="root" AUID="root" SUID="root"
   ...output omitted...
   [root@serverb ~]# logout
   [student@serverb ~]$ logout
   [student@workstation ~]$