Red Hat Security: Linux in Physical, Virtual, and Cloud

Enable the prepackaged STIG Audit rules on servera.

1. Log in to servera as student. No password is required.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 

2. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

3. Copy the /usr/share/doc/audit-2.8.1/rules/30-stig.rules file with the STIG Audit rules to the /etc/audit/rules.d/ directory.

   [root@servera ~]# cp /usr/share/doc/audit-2.8.1/rules/30-stig.rules \
   > /etc/audit/rules.d/

4. Load the STIG Audit rules with the augenrules --load command.

   [root@servera ~]# augenrules --load
   ...output omitted...

Verify that the STIG Audit rules are working correctly.

1. Find the STIG Audit rules that use the identity key.

   [root@servera ~]# grep identity /etc/audit/audit.rules
   -w /etc/group -p wa -k identity
   -w /etc/passwd -p wa -k identity
   -w /etc/gshadow -p wa -k identity
   -w /etc/shadow -p wa -k identity
   -w /etc/security/opasswd -p wa -k identity

2. Create a new user called testuser to test the previous STIG Audit rules. The creation of a new user modifies the files associated with the rules that use the identity key, for example /etc/passwd, and triggers those STIG Audit rules.

   [root@servera ~]# useradd testuser

3. Search the Audit log for the identity key to verify that the previous STIG Audit rules are active.

   [root@servera ~]# ausearch -k identity
   ...output omitted...
   time->Thu Jul 26 06:13:00 2018
   node=servera.lab.example.com type=CONFIG_CHANGE msg=audit(1532599980.002:3490): auid=0 ses=12 op=updated_rules path="/etc/passwd" key="identity" list=4 res=1
   ----
   ...output omitted...
   node=servera.lab.example.com type=SYSCALL msg=audit(1532599980.002:3491): arch=c000003e syscall=82 success=yes exit=0 a0=7fff50bdda70 a1=5596e239ece0 a2=7fff50bdd9e0 a3=5596e360bde0 items=5 ppid=1663 pid=1791 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=12 comm="useradd" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="identity"
   ----
   time->Thu Jul 26 06:13:00 2018
   node=servera.lab.example.com type=CONFIG_CHANGE msg=audit(1532599980.004:3492): auid=0 ses=12 op=updated_rules path="/etc/shadow" key="identity" list=4 res=1
   ----
   ...output omitted...
   node=servera.lab.example.com type=SYSCALL msg=audit(1532599980.004:3493): arch=c000003e syscall=82 success=yes exit=0 a0=7fff50bdda70 a1=5596e239f620 a2=7fff50bdd9e0 a3=757431612f4d4875 items=5 ppid=1663 pid=1791 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=12 comm="useradd" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="identity"
   ----
   time->Thu Jul 26 06:13:00 2018
   node=servera.lab.example.com type=CONFIG_CHANGE msg=audit(1532599980.005:3494): auid=0 ses=12 op=updated_rules path="/etc/group" key="identity" list=4 res=1
   ----
   ...output omitted...
   node=servera.lab.example.com type=SYSCALL msg=audit(1532599980.005:3495): arch=c000003e syscall=82 success=yes exit=0 a0=7fff50bdda70 a1=5596e239e840 a2=7fff50bdd9e0 a3=22 items=5 ppid=1663 pid=1791 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=12 comm="useradd" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="identity"
   ----
   time->Thu Jul 26 06:13:00 2018
   node=servera.lab.example.com type=CONFIG_CHANGE msg=audit(1532599980.007:3496): auid=0 ses=12 op=updated_rules path="/etc/gshadow" key="identity" list=4 res=1
   ----
   ...output omitted...
   node=servera.lab.example.com type=SYSCALL msg=audit(1532599980.007:3497): arch=c000003e syscall=82 success=yes exit=0 a0=7fff50bdda70 a1=5596e239f180 a2=7fff50bdd9e0 a3=2 items=5 ppid=1663 pid=1791 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=12 comm="useradd" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="identity"
   ----
   ...output omitted...

   If you find audit events with the correct key, you have successfully configured the prepackaged Audit rules.

Now that you have configured prepackaged Audit rules move on to the next topic and configure keystroke logging.

Configure the pam_tty_audit PAM module to enable auditing of TTY for the student user on servera.

1. Edit the /etc/pam.d/system-auth and the /etc/pam.d/password-auth files to enable the auditing of TTY for the student user with the pam_tty_audit PAM module.

   [root@servera ~]# vi /etc/pam.d/system-auth
   ...output omitted...
   session    required     pam_tty_audit.so disable=* enable=student
   [root@servera ~]# vi /etc/pam.d/password-auth
   ...output omitted...
   session    required     pam_tty_audit.so disable=* enable=student

2. Log in to servera as student and run the ls /tmp command to test that auditing of TTY is working. When done, log off and then log in to servera as root.

   Note

   Do not use tab completion to type the following commands. This will ensure the actual keystrokes needed to enter those commands are logged for the ls /tmp and logout commands instead of displaying the first few characters and a Tab character.

   This demonstrates something to keep in mind about keystroke logging. The keystrokes actually typed are logged, but you may need to reconstruct what the effect of those keystrokes was, based on the programs being used.

   [root@servera ~]# logout
   [student@servera ~]$ logout
   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ ls /tmp
   ...output omitted...
   [student@servera ~]$ logout
   [student@workstation ~]$ ssh root@servera

3. Verify the Audit logs for the previous commands with the aureport --tty command. When done, log off from servera.

   [root@servera ~]# aureport --tty
   
   TTY Report
   ===============================================
   # date time event auid term sess comm data
   ===============================================
   1. 26/07/18 06:36:58 3750 1000 ? 22 bash "ls /tmp",<ret>,"logout",<ret>
   [root@servera ~]# logout
   [student@workstation ~]$