How to configure network security auditing on Linux

How to configure network security auditing on Linux

Network security auditing is an important process to ensure the security and stability of the network system. Network security auditing on Linux systems can help administrators monitor network activities, discover potential security issues and take timely measures. This article will introduce how to configure network security auditing on Linux and provide code examples to help readers better understand.

1. Install Auditd

Auditd is the default security audit framework for Linux systems. We first need to install Auditd.

On the Ubuntu system, you can install it through the following command:

sudo apt-get install auditd

On the CentOS system, you can install it through the following command:

sudo yum install audit

2. Configure Auditd

After the installation is complete, we need to perform some basic configurations on Auditd. The main configuration file is /etc/audit/auditd.conf. By editing this file, you can adjust some configuration options.

The following is the content of a sample configuration file:

# /etc/auditd.conf
# 注意这里的路径可能因不同系统而有所不同

# 本地日志文件存储的路径
log_file = /var/log/audit/audit.log

# 最大日志文件大小
max_log_file = 50

# 最大日志存储时间
max_log_file_action = keep_logs

# 日志保留的天数
num_days = 30

# 空闲时间（秒）
idletime = 600

# 发现故障后自动停止
space_left_action = email

# 发现故障后实时通知的邮箱地址
admin_space_left_action = root@localhost

# 设定审计系统时额外添加的项目
# 以下是一个示例配置，根据需要可自行调整
# -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at,openat2 -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access

Note that you need to adjust the configuration according to your system and needs. After completing the configuration, save the file and restart the auditd service.

sudo systemctl restart auditd

3. Commonly used Auditd commands

After the configuration is completed, we can use some common Auditd commands to monitor network activities and audit logs.

1. audispd-plugins Plugin

audispd-plugins is an Auditd plug-in that can forward Auditd logs to other tools, such as Syslog or Elasticsearch wait.

On the Ubuntu system, you can install it through the following command:

sudo apt-get install audispd-plugins

On the CentOS system, you can install it through the following command:

sudo yum install audispd-plugins

In the configuration file In /etc/audisp/plugins.d/syslog.conf, you can specify the destination of log forwarding. In the following example, we forward the logs to Syslog:

active = yes
direction = out
path = /sbin/audispd-in_syslog
type = builtin
args = LOG_INFO
format = string

2. ausearch

ausearch is a command line tool for Auditd that can query Audit log. The following are several commonly used command examples:

# 查询所有事件
sudo ausearch -m all

# 查询指定时间段的日志
sudo ausearch --start "10 minutes ago" --end "now"

# 根据用户查询日志
sudo ausearch -ua username

# 根据文件路径查询日志
sudo ausearch -f /path/to/file

# 根据系统调用查询日志
sudo ausearch -sc open

3. aureport

aureport is an Auditd reporting tool that can generate various reports. The following are several commonly used command examples:

# 生成所有的事件报告
sudo aureport

# 生成文件相关的事件报告
sudo aureport -f

# 生成用户相关的事件报告
sudo aureport -i

# 生成系统调用的事件报告
sudo aureport -c

IV. Key configuration examples

The following is a sample configuration for auditing user login and command execution:

sudo auditctl -a always,exit -F arch=b64 -S execve -k command
sudo auditctl -a always,exit -F arch=b64 -S execveat -k command
sudo auditctl -a always,exit -F arch=b32 -S execve -k command
sudo auditctl -a always,exit -F arch=b32 -S execveat -k command
sudo auditctl -a always,exit -F arch=b64 -S sendto -F auid>=500 -F auid!=4294967295 -k connect

The above configuration will record the commands executed by all users and the network traffic sent.

5. Summary

Configuring network security auditing on a Linux system is an important part of ensuring system security. By installing and configuring Auditd, you can monitor network activities and discover potential security issues. This article introduces the installation of Auditd, basic configuration, common commands and key configuration examples, and provides sample code to help readers better understand.

I hope this article can help you conduct network security audits on Linux systems. If you have further questions, please feel free to ask us.

The above is the detailed content of How to configure network security auditing on Linux. For more information, please follow other related articles on the PHP Chinese website!