View

auditd useful commands

  1. #Adding/Modifying Rules
  3. #    Watch for files
  5. auditctl –w /etc/yum.conf -p wa  -k yum_watch
  6. auditctl –w /usr/bin/nmap -p x   -k nmap_watch
  7. auditctl –w /etc/shadow   -p rwa -k shadow_watch
  9. #    Remove a rule using auditctl
  11. auditctl -W /etc/shadow -p rwa -k shadow_watch
  13. #    Watching for ptrace system call
  15. auditctl -a entry,always -F arch=b64 -S ptrace -k info_scan
  17. #    Suppress 32bit clock_gettime & fstat64 system calls
  19. -a entry,never -F arch=b32 -S clock_gettime -k clock_gettime
  20. -a entry,never -F arch=b32 -S fstat64 -k fstat64
  22. #    Audit files opened by a specific user
  24. auditctl -a exit,always -S open -F auid=2010
  25. auditctl -a exit,always -F arch=b64 -F auid=2010  -F uid=2010 -F path=/etc/hosts -S open
  27. #    Audit unsuccessful attempts for multiple system calls where user id is greater than or equal to 500
  29. auditctl -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=500
  30. auditctl -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=500
  32. #Reporting/Searching
  34. #    List all rules
  36. auditctl -l
  38. #    List status
  40. auditctl -s
  42. #    Report on watched files. Date format is local to the server’s date format.
  44. aureport -f
  45. aureport -f –start 02/18/10 17:42:00
  46. aureport -f –start 02/18/10 17:00:00 –end 02/18/10 17:10:00
  47. aureport -f -ts this-week
  48. aureport -f -ts today
  50. #    Search by system call
  52. ausearch -sc ptrace -i
  54. #    Search for user id or effective user id
  56. ausearch -ui 2010
  57. ausearch -ue 2010
  59. #    Lists all auth attempts and their result
  61. aureport -au
  63. #    List just logins
  65. aureport -l
  67. #    List account modification attempts.
  69. aureport -m
  71. #    Search events where success value is no, User id is 500 and key is nmap_watch
  73. ausearch -sv no -ua 500 -k nmap_watch
  75. #    Search by executable
  77. ausearch -x /usr/bin/nmap
  79. #    Search by terminal
  81. ausearch -tm pts/0
  83. #    Search by daemon. Stuff like cron log terminal as the daemon name
  85. ausearch -tm cron
Tags: ,,,,,

You may also like