Red Hat Enterprise Linux 5 Administration Unleashed

514CHAPTER 25Linux Auditing SystemLISTING 25.3Example Audit Rule Log Messagetype=SYSCALL msg=audit(1168206647.422:5227): arch=c000003e syscall=2 success=noexit=-2 a0=7fff37fc5a40 a1=0 a2=2aaaaaaab000 a3=0 items=1 ppid=26640 pid=2716auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501tty=pts5 comm=”vim” exe=”/usr/bin/vim” key=”501open”Writing Audit WatchesThe Linux Auditing System also allows administrators to watch files and directories. If awatch is placed on a file or directory, successful and failed actions such as opening andexecuting the file or directory are logged. To add watches, use the -w option followed by afile or directory to watch.CAUTIONIf you add watches /etc/audit/audit.rules while the daemon is running, be sure toenable the changes with the service auditd restart command as root. Theservice auditd reload command can also be used, but you will not be notified ofconfiguration file errors.Listing 25.4 contains example watches for inclusion in the /etc/audit/audit.rules file. Ifthe -k option is used in conjunction with -w, all records produced by the watch willcontain an alert word (limited to 31 bytes) so that the records for the watch can be easilyfiltered out of the audit log files. To limit file or directory watches to certain actions, usethe -p option followed by one or more of the following: r to watch read actions, w towatch write actions, x to watch execute actions, and a to watch append actions. To deletea watch, use the -W option followed by the file or directory.LISTING 25.4Example Audit Watches#Watch for changes to sysconfig files-w /etc/sysconfig -k SYSCONFIG#Watch for changes to audit config files-w /etc/audit/audit.rules -k AUDIT_RULES-w /etc/audit/auditd.conf -k AUDIT_CONF-w /var/log/audit/ -k LOG_AUDIT#Watch to see who tries to start the VPN client-w /usr/bin/vpnc -k VPNC -p x#Watch password files-w /etc/group -k PASSWD-w /etc/passwd -k PASSWD-w /etc/shadow -k PASSWDFor example, Listing 25.4 includes a watch on the password files with the key filterPASSWD. Listing 25.5 contains the log entries from /var/log/audit/audit.log after