meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
linux:security [2026/06/11 16:30] – titannetlinux:security [2026/06/12 07:56] (current) – titannet
Line 10: Line 10:
 auditreport        # create report auditreport        # create report
  
-/etc/audit/rules.d/audit.rules+/etc/audit/rules.d/##-<name>.rules
 /etc/audit/auditd.conf /etc/audit/auditd.conf
  
Line 21: Line 21:
  
 <code bash> <code bash>
-# basic audit system parameters+# Delete all previous rules
 -D -D
 +# Set buffer size
 -b 8192 -b 8192
--f 1 +# Make the configuration immutable -- reboot is required to change audit rules 
--e 1+-e 2 
 +# Panic when a failure occurs 
 +-f 2 
 +# Generate at most 100 audit messages per second 
 +-r 100 
 +# Make login UID immutable once it is set (may break containers) 
 +--loginuid-immutable 1 
 + 
 +-w /etc/passwd -p wa -k passwd_changes 
 +-w /etc/selinux/ -p wa -k selinux_changes 
 +-w /sbin/insmod -p x -k module_insertion
  
 # some file and directory watches with keys # some file and directory watches with keys