RH413企业安全加固 第15章 配置系统审计

第15章 配置系统审计

环境配置

1、RHEL6.4 SERVER 10.10.10.221

2、RHEL6.4 CLIENT 10.10.10.223

1、审计使用的服务

[root@teachers rsyslog-keys]# service auditd status

auditd (pid 2004) is running...

2、查看/var/log/audit/audit.log文件的时间命令

[root@student audit]# date --date=@1453146601.704

Mon Jan 18 14:50:01 EST 2016

3、使用auditctl命令创建规则

[root@teachers ~]# auditctl -w /etc/passwd -p rx -F uid=500

[root@teachers ~]# auditctl -l

LIST_RULES: exit,always watch=/etc/passwd perm=rx uid=500 (0x1f4)

4、查看/var/log/audit/audit.log

type=SYSCALL msg=audit(1453838986.588:30574): arch=c000003e syscall=2 success=yes exit=3 a0=7f3d9391f69a a1=80000 a2=1b6 a3=0 items=1 ppid=3001 pid=3002 auid=0 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=15 comm="id" exe="/usr/bin/id" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

type=CWD msg=audit(1453838986.588:30574): cwd="/home/student"

type=PATH msg=audit(1453838986.588:30574): item=0 name="/etc/passwd" inode=2885884 dev=08:03 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0

5、删除审计使用参数“-D”

[root@student ~]# auditctl -D

No rules

6、创建带关键字的的审计,可以使用关键字进行搜索

[root@student ~]# auditctl -w /etc/passwd -p rx -F uid=500 -k zhongyaode

[root@student ~]# cat /var/log/audit/audit.log |grep zhongyaode

type=CONFIG_CHANGE msg=audit(1453839635.065:30611): auid=0 ses=2 subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op="add rule" key="zhongyaode" list=4 res=1

type=SYSCALL msg=audit(1453839648.036:30616): arch=c000003e syscall=2 success=yes exit=3 a0=7f1fa1a0369a a1=80000 a2=1b6 a3=0 items=1 ppid=3093 pid=3094 auid=0 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=2 comm="bash" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="zhongyaode"

type=SYSCALL msg=audit(1453839648.038:30617): arch=c000003e syscall=2 success=yes exit=3 a0=7f90ba97169a a1=80000 a2=1b6 a3=0 items=1 ppid=3095 pid=3096 auid=0 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=2 comm="id" exe="/usr/bin/id" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="zhongyaode"

type=SYSCALL msg=audit(1453839648.046:30618): arch=c000003e syscall=2 success=yes exit=3 a0=7f77d45c669a a1=80000 a2=1b6 a3=0 items=1 ppid=3101 pid=3102 auid=0 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=2 comm="id" exe="/usr/bin/id" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="zhongyaode"

type=SYSCALL msg=audit(1453839654.179:30619): arch=c000003e syscall=2 success=yes exit=3 a0=7fffa90888d0 a1=0 a2=7fffa9086980 a3=a items=1 ppid=3094 pid=3117 auid=0 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=2 comm="cat" exe="/bin/cat" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="zhongyaode"

7、通过ausearch 命令查询事件号

[root@student ~]# ausearch -i -a 30616

----

type=PATH msg=audit(01/26/2016 15:20:48.036:30616) : item=0 name=/etc/passwd inode=2885884 dev=08:03 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:etc_t:s0

type=CWD msg=audit(01/26/2016 15:20:48.036:30616) : cwd=/home/student

type=SYSCALL msg=audit(01/26/2016 15:20:48.036:30616) : arch=x86_64 syscall=open success=yes exit=3 a0=7f1fa1a0369a a1=80000 a2=1b6 a3=0 items=1 ppid=3093 pid=3094 auid=root uid=student gid=student euid=student suid=student fsuid=student egid=student sgid=student fsgid=student tty=pts0 ses=2 comm=bash exe=/bin/bash subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=zhongyaode

8、追踪审计事件

[root@student ~]# autrace /bin/date

Waiting to execute: /bin/date

Tue Jan 26 15:39:33 EST 2016

Cleaning up...

Trace complete. You can locate the records with 'ausearch -i -p 3273'

[root@student ~]# ausearch -i -p 3273 | aureport --file -i

File Report

===============================================

# date time file syscall success exe auid event

===============================================

1. 12/31/1969 19:00:01 (null) inode=664418 dev=08:03 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 ? yes ? root 0

9、编写自定义审计规则

[root@teachers ~]# cat /etc/audit/audit.rules |grep 500

-a exit,always -F path=/etc/passwd -F arch=64 -F uid=500 -S all -p rwxa -k zhongyaode

10、练习

1) 配置客户端/etc/rsyslog.conf

[root@student ~]# sed -e '/^#/d' /etc/rsyslog.conf

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)

$ModLoad imklog # provides kernel logging support (previously done by rklogd)

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$IncludeConfig /etc/rsyslog.d/*.conf

*.* @@10.10.10.221:514

$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

:programname, startswith, "spice-vdagent" /var/log/spice-vdagent.log;SpiceTmpl

留下以上这几行其余都注释掉

2) 配置客户审计

[root@student ~]# sed -e '/^#/d' /etc/audit/audit.rules

-D

-b 320

-w /etc/passwd -p rwxa -k zhongyaode -F uid=500

3) 重启客户端服务

[root@student ~]# service auditd restart

Stopping auditd: [ OK ]

Starting auditd: [ OK ]

4) 查看客户端审计配置

[root@student ~]# auditctl -l

LIST_RULES: exit,always watch=/etc/passwd perm=rwxa uid=500 (0x1f4) key=zhongyaode

5) 清除审计日志

[root@student ~]# > /var/log/audit/audit.log

6) 更改为远程端接收审计日志

[root@student ~]# cat /etc/audisp/plugins.d/syslog.conf

# This file controls the configuration of the syslog plugin.

# It simply takes events and writes them to syslog. The

# arguments provided can be the default priority that you

# want the events written with. And optionally, you can give

# a second argument indicating the facility that you want events

# logged to. Valid options are LOG_LOCAL0 through 7.

active = yes

direction = out

path = builtin_syslog

type = builtin

args = LOG_INFO

format = string

7) 重启审计服务和日志服务

[root@student ~]# service auditd restart

Stopping auditd: [ OK ]

Starting auditd: [ OK ]

[root@student ~]# service rsyslog restart

Shutting down system logger: [ OK ]

Starting system logger: [ OK ]

8) 配置SERVER端/etc/rsyslog.conf 配置

$ModLoad imtcp

$InputTCPServerRun 514

打开TCP端口

9) 创建配置服务

[root@teachers ~]# vim /etc/rsyslog.d/audit.conf

:fromhost-ip,isequal,"10.10.10.223" /var/log/studentaudit.log

:fromhost-ip,isequal,"10.10.10.223" ~

10) 重启SERVER端rsyslog服务

[root@teachers ~]# service rsyslog restart

Shutting down system logger: [ OK ]

Starting system logger: [ OK ]

11) 查看SERVER端rsyslog端口是否启用

[root@teachers ~]# netstat -tunpl|grep :514

tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 4589/rsyslogd

tcp 0 0 :::514 :::* LISTEN 4589/rsyslogd

12) 在SERVER端使用实时跟踪命令跟踪远程审计发出的消息

[root@teachers ~]# tail -f /var/log/studentaudit.log

13) 在CLIENT端上执行命令

[root@student ~]# su - student

14) 在SERVER端上的/var/log/studentaudit.log日志出现信息

Jan 26 16:48:13 student.example.com #026#003#002#000V#001#000#000R#003#002V#02541HD#0241h#031'00#000$#0003#000E#0009#0000#026#0002#000D#0008#0000#023#000f#000/#000A#0005#000