meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
linux:security [2026/06/11 16:17] – created titannetlinux:security [2026/06/12 07:56] (current) – titannet
Line 10: Line 10:
 auditreport        # create report auditreport        # create report
  
-/etc/audit/rules.d/audit.rules+/etc/audit/rules.d/##-<name>.rules
 /etc/audit/auditd.conf /etc/audit/auditd.conf
  
Line 21: Line 21:
  
 <code bash> <code bash>
-# basic audit system parameters+# Delete all previous rules
 -D -D
 +# Set buffer size
 -b 8192 -b 8192
--f 1 +# Make the configuration immutable -- reboot is required to change audit rules 
--e 1+-e 2 
 +# Panic when a failure occurs 
 +-f 2 
 +# Generate at most 100 audit messages per second 
 +-r 100 
 +# Make login UID immutable once it is set (may break containers) 
 +--loginuid-immutable 1 
 + 
 +-w /etc/passwd -p wa -k passwd_changes 
 +-w /etc/selinux/ -p wa -k selinux_changes 
 +-w /sbin/insmod -p x -k module_insertion
  
 # some file and directory watches with keys # some file and directory watches with keys
Line 37: Line 48:
 -a entry,always -S umask -a entry,always -S umask
 </code> </code>
 +
 +===== Sysmon for linux =====
 +
 +  * Linux port of sysmon
 +  * Uses eBPF instead of kernel hooks
 +    * extended Berkley Packet Filter
 +  * Creates events instead of log entries (?)
 +
 +<code bash>
 +sudo ./sysmon -accepteula
 +sudo ./sysmon -i
 +
 +systemctl status sysmon
 +
 +
 +</code>
 +
 +<file xml all_in_one.xml>
 +all-in-one.xml
 +<Sysmon schemaversion="4.70">
 +   <EventFiltering>
 +     <!-- Event ID 1 == ProcessCreate. Log all newly created processes -->
 +     <RuleGroup name="" groupRelation="or">
 +       <ProcessCreate onmatch​="exclude"/>
 +     </RuleGroup>
 +     <!-- Event ID 3 == NetworkConnect Detected. Log all network connections -->
 +     <RuleGroup name="" groupRelation="or">
 +       <NetworkConnect onmatch​="exclude"/>
 +     </RuleGroup>
 +     <!-- Event ID 5 == ProcessTerminate. Log all processes terminated -->
 +     <RuleGroup name="" groupRelation="or">
 +       <ProcessTerminate onmatch​="exclude"/>
 +     </RuleGroup>
 +     <!-- Event ID 9 == RawAccessRead. Log all raw access read -->
 +     <RuleGroup name="" groupRelation="or">
 +       <RawAccessRead onmatch​="exclude"/>
 +     </RuleGroup>
 +     <!-- Event ID 10 == ProcessAccess. Log all open process operations -->
 +     <RuleGroup name="" groupRelation="or">
 +       <ProcessAccess onmatch​="exclude"/>
 +     </RuleGroup>
 +     <!-- Event ID 11 == FileCreate. Log every file creation -->
 +     <RuleGroup name="" groupRelation="or">
 +       <FileCreate onmatch​="exclude"/>
 +     </RuleGroup>
 +     <!--Event ID 23 == FileDelete. Log all files being deleted -->
 +     <RuleGroup name="" groupRelation="or">
 +       <FileDelete onmatch​="exclude"/>
 +     </RuleGroup>
 +   </EventFiltering>
 + </Sysmon>
 +</file>
 +
 +<code bash>
 +sudo ./sysmon -c all-in-one.xml
 +</code>
 +
 +<code>
 +sudo tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView
 +
 +sudo tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView -f Image=/bin/cat
 +</code>
 +
 +
 +===== SELinux =====
 +
 +  * Mandatory access control
 +    * ("direct access control" linux file permissions ("directly on file")
 +    * -> Mandatory: generic profile rules
 +      * Each process has domain (label) and each file has label
 +
 +
 +<code bash>
 +
 +
 +</code>
 +