Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
Performance Checklist
In this lab, you will configure remote Audit logs, enable prepackaged STIG Audit rules, and audit TTY.
Outcomes
You should be able to:
Configure remote Audit logs.
Enable prepackaged Audit rules.
Enable auditing of TTY.
Verify that the workstation, servera, and serverb systems are started.
Log in to workstation as student using student as the password.
On workstation, run lab audit-review setup to verify that the environment is ready.
[student@workstation ~]$lab audit-review setup
Configure the Audit service on
serverato send audit messages to the Audit service onserverb.Log in to
serveraasstudent. No password is required.[student@workstation ~]$ssh student@servera[student@servera ~]$Use the sudo -i command to switch identity to the
rootuser. Usestudentas the password.[student@servera ~]$sudo -i[sudo] password for student:student[root@servera ~]#Install the audispd-plugins package.
[root@servera ~]#yum -y install audispd-pluginsIn the
/etc/audisp/plugins.d/au-remote.conffile, set the value for theactivevariable toyesto enable remote logging.[root@servera ~]#vi /etc/audisp/plugins.d/au-remote.conf...output omitted... active =yes...output omitted...In the
/etc/audisp/audisp-remote.conffile, set theremote_servervariable to the IP address of the remote logging server in our environment,serverb.lab.example.com. Also, set the port to be used in the remote logging server,60by default.[root@servera ~]#vi /etc/audisp/audisp-remote.conf...output omitted... remote_server =172.25.250.11port =60...output omitted...Restart the
auditdservice to update its configuration. When done, log off fromservera.[root@servera ~]#service auditd restart[root@servera ~]#logout[student@servera ~]$logout[student@workstation ~]$
Configure the Audit service on
serverbto accept the audit messages from the Audit service onservera.Log in to
serverbasstudent. No password is required.[student@workstation ~]$ssh student@serverb[student@serverb ~]$Use the sudo -i command to switch identity to the
rootuser. Usestudentas the password.[student@serverb ~]$sudo -i[sudo] password for student:student[root@serverb ~]#In the
/etc/audit/auditd.conffile, uncomment thetcp_listen_portvariable, and set its value to60so that the Audit service listens on TCP port 60.[root@serverb ~]#vi /etc/audit/auditd.conf...output omitted... tcp_listen_port =60...output omitted...Open TCP port 60 to enable access to the Audit server.
[root@serverb ~]#firewall-cmd --zone=public --add-port=60/tcp \>--permanentsuccess[root@serverb ~]#firewall-cmd --reloadsuccessRestart the
auditdservice to update its configuration. When done, log off fromserverb.[root@serverb ~]#service auditd restart[root@serverb ~]#logout[student@serverb ~]$logout[student@workstation ~]$
Log in to
serveraasstudentto verify that remote logging for Audit is working.Log in to
serveraasstudent. No password is required.[student@workstation ~]$ssh student@servera[student@servera ~]$Use the sudo -i command to switch identity to the
rootuser. Usestudentas the password. When done, log off fromservera.[student@servera ~]$sudo -i[sudo] password for student:student[root@servera ~]#logout[student@servera ~]$logout[student@workstation ~]$Log in to
serverbasstudent. No password is required.[student@workstation ~]$ssh student@serverb[student@serverb ~]$Use the sudo -i command to switch identity to the
rootuser. Usestudentas the password.[student@serverb ~]$sudo -i[sudo] password for student:student[root@serverb ~]#Verify that new entry in the Audit log file exists for the message created on
servera. When done, log off fromserverb.[root@serverb ~]$grep servera /var/log/audit/audit.log...output omitted... node=servera.lab.example.com type=CRYPTO_KEY_USER msg=audit(1532102732.526:419): pid=2378 uid=0 auid=0 ses=28 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:67:d3:(...):87:9f direction=? spid=2378 suid=0 exe="/usr/sbin/sshd" hostname=servera.lab.example.com addr=? terminal=pts/1 res=success' UID="root" AUID="root" SUID="root" node=servera.lab.example.com type=CRYPTO_KEY_USER msg=audit(1532102732.526:420): pid=2378 uid=0 auid=0 ses=28 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:04:c7:(...):1d:12 direction=? spid=2378 suid=0 exe="/usr/sbin/sshd" hostname=servera.lab.example.com addr=? terminal=pts/1 res=success' UID="root" AUID="root" SUID="root" node=servera.lab.example.com type=CRYPTO_KEY_USER msg=audit(1532102732.526:421): pid=2378 uid=0 auid=0 ses=28 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:f6:bd:(...):12:82 direction=? spid=2378 suid=0 exe="/usr/sbin/sshd" hostname=servera.lab.example.com addr=? terminal=pts/1 res=success' UID="root" AUID="root" SUID="root" ...output omitted...[root@serverb ~]#logout[student@serverb ~]$logout[student@workstation ~]$
Enable the prepackaged STIG Audit rules on
servera.Log in to
serveraasstudent. No password is required.[student@workstation ~]$ssh student@servera[student@servera ~]$Use the sudo -i command to switch identity to the
rootuser. Usestudentas the password.[student@servera ~]$sudo -i[sudo] password for student:student[root@servera ~]#Copy the
/usr/share/doc/audit-2.8.1/rules/30-stig.rulesfile with the STIG Audit rules into the/etc/audit/rules.d/directory.[root@servera ~]#cp /usr/share/doc/audit-2.8.1/rules/30-stig.rules \>/etc/audit/rules.d/Load the STIG Audit rules with the augenrules --load command.
[root@servera ~]#augenrules --load...output omitted...
On
serveraserver create a new user calledtestuserto verify that the STIG Audit rules are working correctly.Verify the STIG Audit rules that use the
identitykey.[root@servera ~]#grep identity /etc/audit/rules.d/30-stig.rules## Things that affect identity -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identityCreate a user called
testuserto test the previous STIG Audit rules. The creation of a new user modifies the files associated with the rules that use theidentitykey, for example/etc/passwd, and triggers those STIG Audit rules.[root@servera ~]#useradd testuserSearch the Audit log for the
identitykey to verify that the previous STIG Audit rules are active.[root@servera ~]#ausearch -k identity...output omitted... time->Thu Jul 26 06:13:00 2018 node=servera.lab.example.com type=CONFIG_CHANGE msg=audit(1532599980.002:3490): auid=0 ses=12 op=updated_rules path="/etc/passwd" key="identity" list=4 res=1 ---- ...output omitted... node=servera.lab.example.com type=SYSCALL msg=audit(1532599980.002:3491): arch=c000003e syscall=82 success=yes exit=0 a0=7fff50bdda70 a1=5596e239ece0 a2=7fff50bdd9e0 a3=5596e360bde0 items=5 ppid=1663 pid=1791 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=12 comm="useradd" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="identity" ---- time->Thu Jul 26 06:13:00 2018 node=servera.lab.example.com type=CONFIG_CHANGE msg=audit(1532599980.004:3492): auid=0 ses=12 op=updated_rules path="/etc/shadow" key="identity" list=4 res=1 ---- ...output omitted... node=servera.lab.example.com type=SYSCALL msg=audit(1532599980.004:3493): arch=c000003e syscall=82 success=yes exit=0 a0=7fff50bdda70 a1=5596e239f620 a2=7fff50bdd9e0 a3=757431612f4d4875 items=5 ppid=1663 pid=1791 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=12 comm="useradd" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="identity" ---- time->Thu Jul 26 06:13:00 2018 node=servera.lab.example.com type=CONFIG_CHANGE msg=audit(1532599980.005:3494): auid=0 ses=12 op=updated_rules path="/etc/group" key="identity" list=4 res=1 ---- ...output omitted... node=servera.lab.example.com type=SYSCALL msg=audit(1532599980.005:3495): arch=c000003e syscall=82 success=yes exit=0 a0=7fff50bdda70 a1=5596e239e840 a2=7fff50bdd9e0 a3=22 items=5 ppid=1663 pid=1791 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=12 comm="useradd" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="identity" ---- time->Thu Jul 26 06:13:00 2018 node=servera.lab.example.com type=CONFIG_CHANGE msg=audit(1532599980.007:3496): auid=0 ses=12 op=updated_rules path="/etc/gshadow" key="identity" list=4 res=1 ---- ...output omitted... node=servera.lab.example.com type=SYSCALL msg=audit(1532599980.007:3497): arch=c000003e syscall=82 success=yes exit=0 a0=7fff50bdda70 a1=5596e239f180 a2=7fff50bdd9e0 a3=2 items=5 ppid=1663 pid=1791 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=12 comm="useradd" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="identity" ---- ...output omitted...
Configure the
pam_tty_auditPAM module to enable auditing of TTY for thestudentuser onservera.Edit the
/etc/pam.d/system-authand the/etc/pam.d/password-authfiles to enable the auditing of TTY for thestudentuser with thepam_tty_auditPAM module.[root@servera ~]#vi /etc/pam.d/system-auth...output omitted... session required pam_tty_audit.so disable=* enable=student[root@servera ~]#vi /etc/pam.d/password-auth...output omitted... session required pam_tty_audit.so disable=* enable=studentLog in to
serveraasstudentand run the ls /tmp command to test that auditing of TTY is working. When done, log in toserveraasroot.[student@workstation ~]$ssh student@servera[student@servera ~]$ls /tmp...output omitted...[student@servera ~]$logout[student@workstation ~]$ssh root@serveraNote
Type these commands in full; do not use tab completion. This ensures that you correctly log the keystrokes for the ls /tmp and the logout commands.
Verify the Audit logs for the previous commands with the aureport --tty command. When done, log off from
servera.[root@servera ~]#aureport --ttyTTY Report =============================================== # date time event auid term sess comm data =============================================== ...output omitted...2. 26/07/18 06:36:58 3750 1000 ? 22 bash "ls /tmp",<ret>,"logout",<ret>[root@servera ~]#logout[student@workstation ~]$
