Red Hat Security: Linux in Physical, Virtual, and Cloud

On servera, add a temporary audit rule that logs every write or attribute change to any file in the /etc directory. Add the config-change key to all log messages.

1. Log in to servera as student. No password is required.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 

2. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

3. Use the auditctl command to add a temporary audit rule that logs every write or attribute change to any file in the /etc directory. Add the config-change key to all log messages.

   [root@servera ~]# auditctl -w /etc/ -p wa -k config-change

4. Create an empty file called /etc/sysconfig/testfile. When done, check your audit logs for all of today's entries with the config-change key.

   [root@servera ~]# touch /etc/sysconfig/testfile
   [root@servera ~]# ausearch --start today -k config-change
   ...output omitted...
   node=servera.lab.example.com type=PATH msg=audit(1533031842.107:970): item=1 name="/etc/sysconfig/testfile" inode=8409786 dev=fc:11 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 objtype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
   node=servera.lab.example.com type=PATH msg=audit(1533031842.107:970): item=0 name="/etc/sysconfig/" inode=8409953 dev=fc:11 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 objtype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
   node=servera.lab.example.com type=CWD msg=audit(1533031842.107:970):  cwd="/root"
   node=servera.lab.example.com type=SYSCALL msg=audit(1533031842.107:970): arch=c000003e syscall=2 success=yes exit=3 a0=7ffd20632713 a1=941 a2=1b6 a3=7ffd20631a90 items=2 ppid=2153 pid=2187 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=38 comm="touch" exe="/usr/bin/touch" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="config-change"
   ...output omitted...

Add a temporary audit rule that logs any execution of a file in the /bin/ directory by a user with an Audit UID of 500 or higher, and an Effective UID of 0. Use the privileged-execution key.

1. Add a temporary audit rule that logs any execution of a file in the /bin/ directory by a user with an Audit UID of 500 or higher, and an Effective UID of 0. Log these audit messages with the privileged-execution key.

   [root@servera ~]# auditctl -w /bin/ -p x -F "auid>=500" -F "euid=0" \
   > -k privileged-execution

2. Execute /bin/true. When done, run an audit search on all of this week's entries with the key privileged-execution.

   [root@servera ~]# /bin/true
   [root@servera ~]# ausearch --start this-week -i \
   > -k privileged-execution
   ----
   node=servera.lab.example.com type=CONFIG_CHANGE msg=audit(31/07/18 06:12:03.868:971) : auid=student ses=38 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op=add_rule key=privileged-execution list=exit res=yes

Persistently add an audit rule to your system that audits all system calls for all users with an Audit UID of 500 or higher. Ensure you specify the rule for both the b32 and b64 system architectures. Give these rules an identifier key of delete. Make sure to exclude auid=4294967295 from these rules.

1. Add the following two lines to /etc/audit/rules.d/audit.rules:

   -a exit,always -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete
   -a exit,always -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete

2. Restart the auditd service to activate your changes.

   [root@servera ~]# service auditd restart

3. As student, create and then immediately delete an empty file called /tmp/testfile.

   [root@servera ~]# logout
   [student@servera ~]$ touch /tmp/testfile; rm /tmp/testfile

4. As root, search for all audit messages with the key delete and the path name /tmp/testfile for this year. When done, log off from servera

   [student@servera ~]$ sudo -i
   [root@servera ~]# ausearch --start this-year -i -k delete \
   > -f /tmp/testfile
   ----
   node=servera.lab.example.com type=PROCTITLE msg=audit(31/07/18 06:14:54.105:990) : proctitle=rm /tmp/testfile
   node=servera.lab.example.com type=PATH msg=audit(31/07/18 06:14:54.105:990) : item=1 name=/tmp/testfile inode=79926 dev=fc:11 mode=file,664 ouid=student ogid=student rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 objtype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0
   node=servera.lab.example.com type=PATH msg=audit(31/07/18 06:14:54.105:990) : item=0 name=/tmp/ inode=82 dev=fc:11 mode=dir,sticky,777 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:tmp_t:s0 objtype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0
   node=servera.lab.example.com type=CWD msg=audit(31/07/18 06:14:54.105:990) :  cwd=/home/student
   node=servera.lab.example.com type=SYSCALL msg=audit(31/07/18 06:14:54.105:990) : arch=x86_64 syscall=unlinkat success=yes exit=0 a0=0xffffffffffffff9c a1=0x1fb2ff0 a2=0x0 a3=0x7ffdcc070c30 items=2 ppid=2108 pid=2252 auid=student uid=student gid=student euid=student suid=student fsuid=student egid=student sgid=student fsgid=student tty=pts1 ses=38 comm=rm exe=/usr/bin/rm subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=delete
   [root@servera ~]# logout
   [student@servera ~]$ logout
   [student@workstation ~]$