audit

Recommendations

Info

LOGGING : AUDITDOUTPUT TYPES1. File2. There is no 2Don’t worry, <strong>audit</strong>d can be extended with “audispd” plugins!
AUDISPD : A MONUMENTAL HACKnew term : “infinite noose”For each plugin, audispd will fork,execve, and send <strong>audit</strong> messagesto stdout.A plugin just has to have the abilityto read from stdin.if this design seems sane to you, keep it a secret, and start sharpening that programming knife
Page 1: INELUCTABLE MODALITYOF LINUX AUDITA
Page 8 and 9: AUDIT IS NOT MAGICALwhat is the mea
Page 10 and 11: CAN’T STOP HERE, THISIS BAT COUNT
Page 12 and 13: FEAR AND LOATHING IN KERNEL/AUDIT.C
Page 14 and 15: FORMAT APPROBATION :)Just follow th
Page 16 and 17: THINE ENEMY LIES WITHIN LEGACYThe m
Page 18 and 19: RULE ONE THROUGH ∞An afterthought
Page 20 and 21: !! WARNING !!No statements about ho
Page 22 and 23: PROCESSING : RAW NETLINKcreating th
Page 24 and 25: PROCESSING : RAW NETLINKreceiving a
Page 26 and 27: PROCESSING : MESSAGE GROUPSan abstr
Page 28 and 29: PARSING“Every year, one out of te
Page 30 and 31: PARSING : BRUTE FORCEone of many ho
Page 32 and 33: PARSING AUDIT MESSAGEStaking things
Page 34 and 35: AND THIS
Page 36 and 37: FILTERINGExample : simple boolean f
Page 40 and 41: LOGGING : OUR WAY1. ZeroMQ2. Syslog
Page 43 and 44: CEREBRATION•Additional methods fo

audit

Create successful ePaper yourself

Delete template?

Save as template?