Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| auditdistd [2012/03/17 12:55] – PawelJakubDawidek | auditdistd [2018/07/17 21:40] (current) – add to CategoryHowTo MateuszPiotrowski | ||
|---|---|---|---|
| Line 10: | Line 10: | ||
| One of the key purposes of logging security events is postmortem analysis in | One of the key purposes of logging security events is postmortem analysis in | ||
| - | case of system compromise. Currently the kernel can push audit records directly | + | case of system compromise. Currently, the kernel can push audit records directly |
| - | into a file or made them available through / | + | into a file or make them available through |
| logs are stored locally by the kernel, an attacker has access to them once the | logs are stored locally by the kernel, an attacker has access to them once the | ||
| system is compromised, | system is compromised, | ||
| Line 20: | Line 20: | ||
| * Security. The auditdistd daemon was designed from the ground up to make use of strong sandboxing techniques, like capsicum(4) and jail(2). Entire network traffic is protected by the TLS encryption. In an event of network protocol compromise sandboxing prevents the attacker from accessing or modifying already delivered audit records, not to mention accessing any other parts of the operating system. | * Security. The auditdistd daemon was designed from the ground up to make use of strong sandboxing techniques, like capsicum(4) and jail(2). Entire network traffic is protected by the TLS encryption. In an event of network protocol compromise sandboxing prevents the attacker from accessing or modifying already delivered audit records, not to mention accessing any other parts of the operating system. | ||
| + | |||
| * Reliability. Audit records are considered delivered only after confirmation from the remote system that they are safely stored on disk. | * Reliability. Audit records are considered delivered only after confirmation from the remote system that they are safely stored on disk. | ||
| - | | + | |
| + | | ||
| + | |||
| + | ===== How does auditdistd work ===== | ||
| + | |||
| + | The auditdistd, depending on the configuration can either run in sender-only mode or in receiver-only mode or in both modes. | ||
| + | |||
| + | In the receiver mode it is responsible for receiving audit records from the sender, storing them locally and confirming. | ||
| + | It does not interpret received audit records mostly to avoid possible bugs in interpreter code and also to not reduce performance. | ||
| + | This also allows to receive audit trail files in an unknown format and continue interrupted connection even in the middle of single audit record. | ||
| + | Special care is taken for the receiver to not touch already received data. It can only open existing file in append-only mode if it is the most recent trail file or create new trail file if it will be newer than any other already received file. | ||
| + | |||
| + | In the sender mode auditdistd relies on auditd(8) to pass all newly created trail files to auditdistd-managed directory (/ | ||
| + | This design choice allows to keep local retention policy for audit trail files totally independent from the existence of auditdistd daemon. If trail file from /var/audit/ needs to be removed, but auditdistd didn't complete sending it yet, only /var/audit/ entry will be removed and the / | ||
| + | |||
| + | ===== Quick start ===== | ||
| + | |||
| + | ==== On the receiver host ==== | ||
| + | |||
| + | Ensure | ||
| + | |||
| + | < | ||
| + | # grep ^auditdistd: | ||
| + | auditdistd: | ||
| + | </ | ||
| + | |||
| + | Ensure that the / | ||
| + | |||
| + | < | ||
| + | drwx------ | ||
| + | </ | ||
| + | |||
| + | If not: | ||
| + | |||
| + | < | ||
| + | # mkdir -m 0700 / | ||
| + | # chown auditdistd: | ||
| + | </ | ||
| + | |||
| + | Generate private key and self-signed certificate for the receiver. Auditdistd verifies public key's finger print and does not perform whole PKI verification path. Finger print verification | ||
| + | This is the quickest method of generating x509 certificate, | ||
| + | |||
| + | < | ||
| + | # openssl req -x509 -nodes -newkey rsa:4096 -days 1825 -batch \ | ||
| + | -out / | ||
| + | -keyout / | ||
| + | # chmod 0600 / | ||
| + | # chown root:wheel / | ||
| + | </ | ||
| + | |||
| + | Print certificate public key's finger print in a form ready to be pasted into sender' | ||
| + | |||
| + | < | ||
| + | # openssl x509 -in / | ||
| + | awk -F '[ =]' ' | ||
| + | SHA256=8F: | ||
| + | </ | ||
| + | |||
| + | Generate password used to authenticate both hosts against each other. For example this way: | ||
| + | |||
| + | < | ||
| + | # dd if=/ | ||
| + | YjwbK69H5cEBlhcT+eJpJgJTFn5B2SrG | ||
| + | </ | ||
| + | |||
| + | Create / | ||
| + | |||
| + | < | ||
| + | receiver { | ||
| + | host " | ||
| + | remote " | ||
| + | password " | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | Don't forget to change sender' | ||
| + | |||
| + | Because the configuration file contains passwords, set its permissions properly: | ||
| + | |||
| + | < | ||
| + | # chmod 600 / | ||
| + | # chown root:wheel / | ||
| + | </ | ||
| + | |||
| + | Add the following line to the / | ||
| + | |||
| + | < | ||
| + | auditdistd_enable=" | ||
| + | </ | ||
| + | |||
| + | And run: | ||
| + | |||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | ==== On the sender host ==== | ||
| + | |||
| + | Ensure your kernel is compiled with: | ||
| + | |||
| + | < | ||
| + | options AUDIT | ||
| + | </ | ||
| + | |||
| + | by checking if sysctl kern.features.audit exists and is set to 1. | ||
| + | |||
| + | Ensure that the auditdistd user exists: | ||
| + | |||
| + | < | ||
| + | # grep ^auditdistd: | ||
| + | auditdistd: | ||
| + | </ | ||
| + | |||
| + | Ensure that the / | ||
| + | |||
| + | < | ||
| + | drwxrwx--- | ||
| + | </ | ||
| + | |||
| + | If not: | ||
| + | |||
| + | < | ||
| + | # mkdir -m 0770 / | ||
| + | # chown auditdistd: | ||
| + | </ | ||
| + | |||
| + | Add the following line to the / | ||
| + | |||
| + | < | ||
| + | dist:on | ||
| + | </ | ||
| + | |||
| + | Turn on events auditing by starting auditd(8) daemon. | ||
| + | Add the following line to the / | ||
| + | |||
| + | < | ||
| + | auditd_enable=" | ||
| + | </ | ||
| + | |||
| + | And run: | ||
| + | |||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Create / | ||
| + | |||
| + | < | ||
| + | sender { | ||
| + | host " | ||
| + | remote " | ||
| + | fingerprint " | ||
| + | password " | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | Because the configuration file contains passwords, set its permissions properly: | ||
| + | |||
| + | < | ||
| + | # chmod 600 / | ||
| + | # chown root:wheel / | ||
| + | </ | ||
| + | |||
| + | Add the following line to the / | ||
| + | |||
| + | < | ||
| + | auditdistd_enable=" | ||
| + | </ | ||
| + | |||
| + | And run: | ||
| + | |||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | ---- | ||
| + | |||
| + | {{tag> | ||