This project is part of TrustedBSD project and aims to provide auditing support to security-related events generated by various firewall implementations on FreeBSD such as IPFW, PF and IPFILTER. You might want to check the project's Perforce Repository.

My name is DiegoGiagio and I'm being mentored by ChristianPeron. You can also check my blog at http://blogs.freebsdish.org/diego.

1. Checkout diego_audit branch from perforce.FreeBSD.org
2. Build the kernel from the branch with AUDIT option enabled
3. Build and install OpenBSM from the branch
4. Enable 'fl' events on /etc/security/audit_control
5. Enable auditd daemon by adding auditd_enable=“YES” to /etc/rc.conf
6. Reboot or restart /etc/rc/auditd manually.

After rebooting the new kernel, every administrative firewall action (like adding or removing rules) will generate audit records to your audit trail, which can be found into /var/audit by default. Also, every connection that passes through rules with 'audit' keyword will generate flow audit records. Currently only ipfw is supported.

Audit records are generated after the occurrence of a security-related firewall event. There are two types of events:

• Administrative Events
• Network Events

These are records generated after executing firewall administrative actions. When auditing is enabled, these type of records are always generated. This is not true for Network Events, where only firewall rules marked as “audit” by user-land utilities can be used to generate records.

These are records generated by the firewall implementation after occurrence of a security-related network event. Only firewall rules marked as “audit” can be used to generate records.