Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
In this exercise, you will search for events in your system, create reports for those events, and trace the execution of a command.
Outcomes
You should be able to search for events and generate reports from the audit log and interpret the results.
Verify that the workstation and servera systems are started.
Log in to workstation as student using student as the password.
On workstation, run lab audit-inspect setup to verify that the environment is ready.
[student@workstation ~]$lab audit-inspect setup
Generate a report of all login events on
servera.Log in to
serveraasstudent. No password is required.[student@workstation ~]$ssh student@servera[student@servera ~]$Use the sudo -i command to switch identity to the
rootuser. Usestudentas the password.[student@servera ~]$sudo -i[sudo] password for student:student[root@servera ~]#Generate a report of all login events with the aureport command. Use the time stamps to determine the most recent login event from
workstation.lab.example.comand take note of the event ID. In the following example it is event 188, but your output might be different.[root@servera ~]#aureport --loginLogin Report ============================================ # date time auid host term exe success event =========================================== ...output omitted...5. 20/07/18 05:27:47 0workstation.lab.example.com/dev/pts/0 /usr/sbin/sshd yes188
Retrieve more information about the previous event with the ausearch command. Use the
-ioption to interpret the results to a more human-readable format.[root@servera ~]#ausearch -i -a...output omitted... ---- node=servera.lab.example.com type=USER_LOGIN msg=audit(31/07/18 05:58:55.418:188188) : pid=1903 uid=root auid=student ses=33 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=student exe=/usr/sbin/sshd hostname=workstation.lab.example.com addr=172.25.250.254 terminal=/dev/pts/0 res=success' ---- ...output omitted...Use the aureport --summary command to generate an Executable Summary Report of command executions. Remember that not all commands are logged by default, but rather only commands that trigger audit events, such as su and sudo. The report may look different on your system.
[root@servera ~]#aureport --executable --summaryExecutable Summary Report ================================= total file ================================= 498 /usr/sbin/crond 311 /usr/lib/systemd/systemd 243 /usr/sbin/sshd 112 /usr/sbin/xtables-multi 20 /usr/bin/kmod 20 /usr/bin/sudo 18 /usr/sbin/ebtables-restore 14 /usr/sbin/groupadd 8 /usr/sbin/useradd 6 /usr/lib/systemd/systemd-update-utmp 2 /usr/bin/passwdSearch for all audit events of the
LOGINtype, and export them in CSV format. Store the results in aresults.csvfile for future use.[root@servera ~]#ausearch -m LOGIN --format csv > results.csv[root@servera ~]#cat results.csvNODE,EVENT,DATE,TIME,SERIAL_NUM,EVENT_KIND,SESSION,SUBJ_PRIME,SUBJ_SEC, SUBJ_KIND,ACTION,RESULT,OBJ_PRIME,OBJ_SEC,OBJ_KIND,HOW ,LOGIN,06/07/18,01:50:01,131,user-login,1,system,root,priviliged-acct,changed-login-id-to,success,root,,user-session, ,LOGIN,06/07/18,02:00:01,138,user-login,2,system,root,priviliged-acct,changed-login-id-to,success,root,,user-session, ,LOGIN,06/07/18,02:01:01,145,user-login,3,system,root,priviliged-acct,changed-login-id-to,success,root,,user-session, ...output omitted...Use the audit system to trace the execution of the /bin/ls /tmp command. When done, create a file report for all files opened by the previous command.
[root@servera ~]#autrace /bin/ls /tmpWaiting to execute: /bin/ls rht-wkssystemd-private-08f64ec5ec4844079ef98aa1dbf95a3f-chronyd.service-xaEv5kCleaning up... Trace complete. You can locate the records with 'ausearch -i -p1355'Use the ausearch -i -p 1355 command to review the records.
[root@servera ~]#ausearch -i -p 1355...output omitted... node=servera.lab.example.com type=PROCTITLE msg=audit(08/16/2018 04:18:15.506:485) : proctitle=autrace /bin/ls /tmp node=servera.lab.example.com type=SYSCALL msg=audit(08/16/2018 04:18:15.506:485) : arch=x86_64 syscall=close success=yes exit=0 a0=0x1 a1=0x7fa8cdcfe000 a2=0x7fa8cd49f858 a3=0x7fffdcefdf50 items=0 ppid=1925 pid=1927 auid=student uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=16 comm=ls exe=/usr/bin/ls subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ---- node=servera.lab.example.com type=PROCTITLE msg=audit(08/16/2018 04:18:15.506:486) : proctitle=autrace /bin/ls /tmp node=servera.lab.example.com type=SYSCALL msg=audit(08/16/2018 04:18:15.506:486) : arch=x86_64 syscall=munmap success=yes exit=0 a0=0x7fa8cdcfe000 a1=0x1000 a2=0x0 a3=0x7fffdcefdf50 items=0 ppid=1925 pid=1927 auid=student uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=16 comm=ls exe=/usr/bin/ls subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ---- node=servera.lab.example.com type=PROCTITLE msg=audit(08/16/2018 04:18:15.506:487) : proctitle=autrace /bin/ls /tmp node=servera.lab.example.com type=SYSCALL msg=audit(08/16/2018 04:18:15.506:487) : arch=x86_64 syscall=close success=yes exit=0 a0=0x2 a1=0x1 a2=0x7fa8cd49f858 a3=0x7fffdcefdf50 items=0 ppid=1925 pid=1927 auid=student uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=16 comm=ls exe=/usr/bin/ls subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ---- node=servera.lab.example.com type=PROCTITLE msg=audit(08/16/2018 04:18:15.506:488) : proctitle=autrace /bin/ls /tmp node=servera.lab.example.com type=SYSCALL msg=audit(08/16/2018 04:18:15.506:488) : arch=x86_64 syscall=exit_group a0=EXIT_SUCCESS a1=0x0 a2=0x0 a3=0xfffffffffffffe80 items=0 ppid=1925 pid=1927 auid=student uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=16 comm=ls exe=/usr/bin/ls subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)Use the ausearch -p 1355 --raw to review the records in the raw format.
[root@servera ~]#ausearch -p...output omitted... node=servera.lab.example.com type=PROCTITLE msg=audit(1534407495.506:485): proctitle=61757472616365002F62696E2F6C73002F746D70 node=servera.lab.example.com type=SYSCALL msg=audit(1534407495.506:486): arch=c000003e syscall=11 success=yes exit=0 a0=7fa8cdcfe000 a1=1000 a2=0 a3=7fffdcefdf50 items=0 ppid=1925 pid=1927 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=16 comm="ls" exe="/usr/bin/ls" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=munmap AUID="student" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" node=servera.lab.example.com type=PROCTITLE msg=audit(1534407495.506:486): proctitle=61757472616365002F62696E2F6C73002F746D70 node=servera.lab.example.com type=SYSCALL msg=audit(1534407495.506:487): arch=c000003e syscall=3 success=yes exit=0 a0=2 a1=1 a2=7fa8cd49f858 a3=7fffdcefdf50 items=0 ppid=1925 pid=1927 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=16 comm="ls" exe="/usr/bin/ls" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=close AUID="student" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" node=servera.lab.example.com type=PROCTITLE msg=audit(1534407495.506:487): proctitle=61757472616365002F62696E2F6C73002F746D70 node=servera.lab.example.com type=SYSCALL msg=audit(1534407495.506:488): arch=c000003e syscall=231 a0=0 a1=0 a2=0 a3=fffffffffffffe80 items=0 ppid=1925 pid=1927 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=16 comm="ls" exe="/usr/bin/ls" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=exit_group AUID="student" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" node=servera.lab.example.com type=PROCTITLE msg=audit(1534407495.506:488): proctitle=61757472616365002F62696E2F6C73002F746D701355--rawUse the ausearch -p
1355--raw|aureport -i file command to create a file report.[root@servera ~]#ausearch -pFile Report =============================================== # date time file syscall success exe auid event =============================================== 1. 08/16/2018 04:30:28 /bin/ls execve yes /usr/bin/ls student 513 2. 08/16/2018 04:30:28 /etc/ld.so.preload access no /usr/bin/ls student 516 3. 08/16/2018 04:30:28 /etc/ld.so.cache open yes /usr/bin/ls student 517 4. 08/16/2018 04:30:28 /lib64/libselinux.so.1 open yes /usr/bin/ls student 521 5. 08/16/2018 04:30:28 /lib64/libcap.so.2 open yes /usr/bin/ls student 529 ...output omitted...1355--raw | aureport -i --file
Repeat the trace above, but now with the /bin/ls -l /tmp command. Note that the
-loption triggers a call to thelstatsystem call that provides additional detailed information, such as permissions or size. When done, log off fromservera.[root@servera ~]#autrace /bin/ls -l /tmpWaiting to execute: /bin/ls total 72 -rwxr-xr-x. 1 root root 57361 Aug 13 08:38 bootstrap.py -rw-r--r--. 1 root root 126 Aug 13 08:37 rht -rw-r--r--. 1 root root 450 Aug 13 08:37 rht-vm-hosts -rw-r--r--. 1 root root 182 Aug 16 02:53 rht-wks drwx------. 3 root root 17 Aug 16 02:53systemd-private-b4bd7591032b4e559ac599215de5aa02-chronyd.service-d0VznlCleaning up... Trace complete. You can locate the records with 'ausearch -i -p 1961'[root@servera ~]#logout[student@servera ~]$logout[student@workstation ~]$
