====== Receiving Linux Audit trails with auditdistd ====== | //Repository// | [[https://github.com/0mp/audisp-auditdistd/]] | The aim of this project is to develop a solution, which enables receiving audit trails, generated by the Linux Audit subsystem, with the auditdistd daemon running on %%FreeBSD%%. Hit //Comments// in the Edit Bar to see other solutions and notes, which are otherwise hidden for readability. ===== Considered solutions ===== It looks like auditdistd is able to launch on Linux without major problems. It might be a good idea to use it instead of coming up with an entirely new solution. Here are the possible ways to utilize existing auditdistd code: ==== Helper plugin ==== * **Idea** * Create a plugin for the Linux Audit subsystem, which copies files containing audit logs into a separate directory managed only by an auditdistd daemon. Actually, this approach might result in implementing simpler version of %%FreeBSD%% auditd, because this is a program which prepares and manages files auditdistd consumes. === Advantages === * The plugin should be able to simulate the %%FreeBSD%%-way of adding audit trail files to a directory managed by auditdistd. This way auditdistd doesn't have to be modified (//much//?) as the log files will appear in its directory like if it was being ran on %%FreeBSD%%. === Disadvantages === * It might be difficult to simulate the behavior, which auditdistd is expecting from %%FreeBSD%%, on Linux. * If we are going to copy the files to a directory managed by an auditdistd daemon, then depending on the Linux Audit subsystem configuration, the solution might be using twice as much disk space to store audit trails because a copy of every audit trail will be stored in files created exclusively for auditdistd needs. === Tasks === * {o} {1} [[#I1]] Compare the ways %%FreeBSD%% and the Linux Audit subsystem handle audit trail files * Comment: I've analyzed the auditdistd source code so far. It seems pretty obvious now that the plugin for audispd from the Linux Audit subsystem should be a reimplementation of the %%OpenBSM%% auditd daemon. It looks like there are already two implementations: one for Darwin (macOS) and one for %%FreeBSD%%. * {o} [[#I2]] Create an implementation of %%OpenBSM%% auditd suitable to be used as a plugin for Linux Audit audispd * {o} {2} [[#I3]] Hack the %%OpenBSM%% Linux build * Comment: The current state of the %%OpenBSM%% Linux build is that auditd and auditdistd seem to compile just fine, except the undefined references to functions and audit syscalls like ''%%setaudit%%'', which are not available on Linux. * {o} {1} [[#I4]] Do something about the audit system calls and functions missing from libauditd. * Comment: The missing functions are: ''%%audit_get_cond%%'', ''%%setaudit%%'', ''%%audit_set_class%%'', ''%%audit_set_fsize%%'', ''%%audit_set_kmask%%'', ''%%audit_set_policy%%'', ''%%au_close%%'', ''%%auditctl%%'', ''%%audit_set_qctrl%%'', ''%%audit_set_event%%'', ''%%audit_get_qctrl%%'', ''%%audit_set_kaudit%%''. * {o} {3} [[#I5]] Teach the plugin to read audit trails from standard input * {o} {1} [[#I6]] Remove unnecessary code * Comment: Maybe it will solve [[#2]]? * {o} [[#I7]] Should the plugin create a pidfile? Maybe the value of ''%%AUDITD_PIDFILE%%'' in ''%%auditd.h%%'' should be changed? * {*} [[#I8]] Change the trigger file name * Comment: The trigger file itself might be useful in the future but it should probably be renamed from ''%%/dev/auditd%%''. * {o} [[#I9]] Should the plugin be audited or should it call ''%%auditd_prevent_audit%%''? * It will be removed for now. ==== Reconfigured auditdistd ==== * **Idea** * Reconfigure auditdistd, so that it could read log files directly from the Linux Audit auditd daemon directory (''%%/var/log/audit/%%'' seems to be the default one, ''%%audit.log%%'' being the default file fresh logs are saved to). === Advantages === * Probably the simplest solution; the user only has to point auditdistd on Linux to suitable directories and configuration files. === Disadvantages === * It's very likely that it is an inherently bad idea to let both auditdistd and the Linux Audit subsystem manage a directory of audit trail files at the same time. ===== Modified auditdistd ===== * **Idea** * Modify auditdistd so that it could be used directly as an plugin for audispd (Linux Audit plugins receive logs through the standard input). ==== Advantages ==== * One less program involved in the process of sending logs. ==== Disadvantages ==== * Auditdistd code adaptation and modification, which is a very similar solution to the original idea of creating a brand new Linux Audit plugin capable of communicating with auditdistd running on %%FreeBSD%%. ==== Tasks ==== * {*} [[#II-5]] Set up an environment with Linux and %%FreeBSD%%. * For the time being I'm using Vagrant for that. * {*} [[#II-1]] Provide a shell script to add files required by auditdistd to run. * {o} [[#II-11]] Port proto files to Linux. * {o} [[#II-9]] Find a Linux alternative to the proto library used by auditdistd. * Search under //linux socket networking library//. * {o} [[#II-10]] Try to separate proto files and pjdlog fiels from auditdistd into separate libraries. * If there is a Linux alternative to libproto, then use it in the Linux port of auditdistd. * {o} [[#II-6]] Make a connection between Linux auditdistd and %%FreeBSD%% auditdistd. * Also while here: * {o} [[#II-7]] Explain the segfault on Linux when killing auditdistd with SIGINT. * {o} [[#II-8]] Explain why %%FreeBSD%% auditdistd prints ''%%[ERROR] [TLS sandbox] (server) SSL I/O error.%%'', when Linux auditdistd is trying to establish a connection over the internal audidistd protocol with it. * -The auditdistd code has never been tested on Linux-based systems. As a result some ifdefs might be misplaced, especially those controlling various sandboxing technologies like [[/Capsicum]]. * It it not the problem of ifdefs. * The whole issue might be irrelevant. * {o} [[#II-2]] Add a thread capable of doing the job of auditd. * This is it will be possible to use auditdistd directly as a Linux audispd plugin. * {o} [[#II-3]] Read from stdin. * {o} [[#II-4]] Write to some ''%%dist%%'' directory so that auditdistd could read from it. ==== Files ==== * {{mateuszpiotrowski/audit/receivinglinuxaudittrailswithauditdistd/output-of-strace-of-client-auditdistd-on-linux-as-of-db400c6b5886454992cd0ea1514fd4608067df7d.txt?linkonly|output-of-strace-of-client-auditdistd-on-linux-as-of-db400c6b5886454992cd0ea1514fd4608067df7d.txt}} ===== References & notes ===== * [[MateuszPiotrowski/Audit/Auditdistd|Notes about the auditdistd implementation (MateuszPiotrowski/Audit/Auditdistd)]] * [[/TrustedBSD]] * [[http://www.trustedbsd.org/openbsm.html|OpenBSM homepage]] * [[https://github.com/openbsm/openbsm|OpenBSM GitHub repository]] * [[https://code.google.com/archive/p/linuxopenbsm/|Repository of Linux OpenBSM, an abandoned project from 2008 (code.google.com)]] * IRC channel: [[https://webchat.freenode.net/?channels=%23openbsm|Freenode/#openbsm]] * Issues: * [[https://github.com/openbsm/openbsm/issues/18|Why do we need #ifndef HAVE_AUDIT_SYSCALLS in bin/auditdistd/parse.y? (github.com/openbsm/openbsm/issues/)]] * Old P4 (Perforce) repositories with a lot of very old commits from the beginnings of %%OpenBSM%%. There's a lot of information to be found in those commit messages: * [[https://p4web.freebsd.org/@md=d&cd=//depot/projects/trustedbsd/openbsm/bin/auditdistd/&c=QJt@//depot/projects/trustedbsd/openbsm/?ac=83|TrustedBSD repository of OpenBSM]] * [[https://p4web.freebsd.org/@md=d&cd=//depot/projects/trustedbsd/openbsm/bin/auditdistd/&c=ngV@//depot/user/pjd/openbsm/?ac=83|pjd@ repository of OpenBSM]] ==== Related Linux man pages ==== * [[http://man7.org/linux/man-pages/man8/audispd.8.html|audispd(8)]] * [[http://man7.org/linux/man-pages/man8/auditd.8.html|auditd(8)]] ---- {{tag>Project Todo}}