====== Linux Security ======

===== Auditd =====

  * Extended logging based on auditd rules

<code bash>
auditctl           # configure rules
auditsearch        # search for events
auditreport        # create report

/etc/audit/rules.d/##-<name>.rules
/etc/audit/auditd.conf

auditctl -w path_to_file -p permissions -k key_name
# or in rules file:
-w path_to_file -p permissions -k key_name

sudo ausearch -i -k user-modify
</code>

<code bash>
# Delete all previous rules
-D
# Set buffer size
-b 8192
# Make the configuration immutable -- reboot is required to change audit rules
-e 2
# Panic when a failure occurs
-f 2
# Generate at most 100 audit messages per second
-r 100
# Make login UID immutable once it is set (may break containers)
--loginuid-immutable 1

-w /etc/passwd -p wa -k passwd_changes
-w /etc/selinux/ -p wa -k selinux_changes
-w /sbin/insmod -p x -k module_insertion

# some file and directory watches with keys
-w /var/log/audit/ -k LOG_audit
-w /etc/audit/auditd.conf -k CFG_audit_conf -p rxwa
-w /etc/audit/audit.rules -k CFG_audit_rules -p rxwa

-w /etc/passwd -k CFG_passwd -p rwxa
-w /etc/sysconfig/ -k CFG_sysconfig
# an example system call rule
-a entry,always -S umask
</code>

===== Sysmon for linux =====

  * Linux port of sysmon
  * Uses eBPF instead of kernel hooks
    * extended Berkley Packet Filter
  * Creates events instead of log entries (?)

<code bash>
sudo ./sysmon -accepteula
sudo ./sysmon -i

systemctl status sysmon


</code>

<file xml all_in_one.xml>
all-in-one.xml
<Sysmon schemaversion="4.70">
	  <EventFiltering>
	    <!-- Event ID 1 == ProcessCreate. Log all newly created processes -->
	    <RuleGroup name="" groupRelation="or">
	      <ProcessCreate onmatch​="exclude"/>
	    </RuleGroup>
	    <!-- Event ID 3 == NetworkConnect Detected. Log all network connections -->
	    <RuleGroup name="" groupRelation="or">
	      <NetworkConnect onmatch​="exclude"/>
	    </RuleGroup>
	    <!-- Event ID 5 == ProcessTerminate. Log all processes terminated -->
	    <RuleGroup name="" groupRelation="or">
	      <ProcessTerminate onmatch​="exclude"/>
	    </RuleGroup>
	    <!-- Event ID 9 == RawAccessRead. Log all raw access read -->
	    <RuleGroup name="" groupRelation="or">
	      <RawAccessRead onmatch​="exclude"/>
	    </RuleGroup>
	    <!-- Event ID 10 == ProcessAccess. Log all open process operations -->
	    <RuleGroup name="" groupRelation="or">
	      <ProcessAccess onmatch​="exclude"/>
	    </RuleGroup>
	    <!-- Event ID 11 == FileCreate. Log every file creation -->
	    <RuleGroup name="" groupRelation="or">
	      <FileCreate onmatch​="exclude"/>
	    </RuleGroup>
	    <!--Event ID 23 == FileDelete. Log all files being deleted -->
	    <RuleGroup name="" groupRelation="or">
	      <FileDelete onmatch​="exclude"/>
	    </RuleGroup>
	  </EventFiltering>
	</Sysmon>
</file>

<code bash>
sudo ./sysmon -c all-in-one.xml
</code>

<code>
sudo tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView

sudo tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView -f Image=/bin/cat
</code>


===== SELinux =====

  * Mandatory access control
    * ("direct access control" linux file permissions ("directly on file")
    * -> Mandatory: generic profile rules
      * Each process has domain (label) and each file has label


<code bash>


</code>