meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
linux:security [2026/06/11 16:23] – titannetlinux:security [2026/06/12 07:56] (current) – titannet
Line 10: Line 10:
 auditreport        # create report auditreport        # create report
  
-/etc/audit/rules.d/audit.rules+/etc/audit/rules.d/##-<name>.rules
 /etc/audit/auditd.conf /etc/audit/auditd.conf
  
Line 21: Line 21:
  
 <code bash> <code bash>
-# basic audit system parameters+# Delete all previous rules
 -D -D
 +# Set buffer size
 -b 8192 -b 8192
--f 1 +# Make the configuration immutable -- reboot is required to change audit rules 
--e 1+-e 2 
 +# Panic when a failure occurs 
 +-f 2 
 +# Generate at most 100 audit messages per second 
 +-r 100 
 +# Make login UID immutable once it is set (may break containers) 
 +--loginuid-immutable 1 
 + 
 +-w /etc/passwd -p wa -k passwd_changes 
 +-w /etc/selinux/ -p wa -k selinux_changes 
 +-w /sbin/insmod -p x -k module_insertion
  
 # some file and directory watches with keys # some file and directory watches with keys
Line 97: Line 108:
 sudo tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView sudo tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView
  
 +sudo tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView -f Image=/bin/cat
 </code> </code>
 +
 +
 +===== SELinux =====
 +
 +  * Mandatory access control
 +    * ("direct access control" linux file permissions ("directly on file")
 +    * -> Mandatory: generic profile rules
 +      * Each process has domain (label) and each file has label
 +
 +
 +<code bash>
 +
 +
 +</code>
 +