Red Hat Security: Linux in Physical, Virtual, and Cloud

Objectives

After completing this section, students should be able to enable standard Audit rule sets provided with Red Hat Enterprise Linux and identify potentially useful rule sets.

Prepackaged Audit Rule Sets

When you need to implement a practical security policy, you should look at the prepackaged rule sets that ship with the audit package. These rules are available in the /usr/share/doc/audit-*/rules directory as files with the suffix .rules. The /usr/share/doc/audit-*/rules/README-rules file provides some basic background, and the individual rule files contain comments on how they should be used and whether additional rule files should also be loaded.

The names of the rule files each start with a number to help ensure that they are loaded in the correct order. Remember that order is important when loading rules.

Some of the provided rule files include:

Additional example rule files are also provided. Each rule file contains several individual rules. Only the uncommented rules are enabled for loading and you should not enable all of the rules in the file at the same time. If you do, some of the rules may not match in the way you expected.

Enabling Prepackaged Rule Sets

To use one of these prepackaged rule sets, copy the .rules file or files to the /etc/audit/rules.d directory, and run the augenrules --load command to reload the Audit rules. These example files do not guarantee full compliance as written, but give you a starting point to configure your environment.

After copying one of these default rule sets you need to review the file and follow any instructions to enable or disable certain rules for your environment. For example, the 99-finalize.rules file contains a commented-out control rule to make the rule configuration immutable. You need to enable that for production.

Full Terminal Keystroke Logging

Some auditing policies require that every keystroke a user makes is logged. Audit provides this functionality in conjunction with the pam_tty_audit PAM module. Every keystroke is then recorded in the audit log (/var/log/audit/audit.log).

To enable keystroke logging, you have to add the pam_tty_audit module to the /etc/pam.d/system-auth and the /etc/pam.d/password-auth files, so all daemons started by the system that implement some form of terminal functionality have their keystrokes logged as well, unless explicitly disabled in their PAM configuration.

The pam_tty_audit module takes either the enable or the disable options. Both options take as arguments a comma-separated list of patterns for user names to enable and disable, respectively. The following example enables keystroke logging for the demo user, and disables it for all other users.

[root@demo ~]# vi /etc/pam.d/system-auth
...output omitted...
session required pam_tty_audit.so disable=* enable=demo
...output omitted...
[root@demo ~]# vi /etc/pam.d/password-auth
...output omitted...
session required pam_tty_audit.so disable=* enable=demo
...output omitted...

If both an enable= pattern and a disable= pattern match a user, the last one on the command line applies.

To convert the data logged in the Audit system to a more readable format, you can use the aureport --tty command.