auditdistd - Audit trail files distribution daemon

Security Event Audit is a facility to provide fine-grained, reliable and configurable logging of a variety of security-relevant system events, including logins, configuration changes, and file and network access.

One of the key purposes of logging security events is postmortem analysis in case of system compromise. Currently the kernel can push audit records directly into a file or made them available through /dev/auditpipe device. Because audit logs are stored locally by the kernel, an attacker has access to them once the system is compromised, which enables him to remove trails of his activity.

The auditdistd daemon distributes audit records over the TCP/IP network from a local system to a remote system also running the auditdistd daemon. The project focuses on:

• Security. The auditdistd daemon was designed from the ground up to make use of strong sandboxing techniques, like capsicum(4) and jail(2). Entire network traffic is protected by the TLS encryption. In an event of network protocol compromise sandboxing prevents the attacker from accessing or modifying already delivered audit records, not to mention accessing any other parts of the operating system.
• Reliability. Audit records are considered delivered only after confirmation from the remote system that they are safely stored on disk.
• Speed. The auditdistd daemon uses kqueue(2) to be quickly notified about new audit records, so it can distribute them as fast as possible. The goal here is to increase number of trusted audit records, as we cannot trust anything that is produced by the system after its compromise.