Auditing device files using auditcl daemon

Question

I am trying to see what commands are typed in my terminal and serial port. For that I am using auditd daemon which helps me in auditing files.

I thought of a creating audit rules on /dev/tty and /dev/ttyAMA0 for seeing whats happening on terminal and serial device respectively.

auditctl -w /dev/tty -p rwx -k terminal

auditctl -w /dev/ttyAMA0 -p rwx -k serialport

But this records only the echo on tty. I cant audit all the commands typed on the terminal. I enabled tty logging in the PAM file too by adding session required pam_tty_audit.so enable=* in /etc/pam.d/sshd file.

Is there any other way to do this auditing. I want to use auditd daemon only so that all my auditing log is in one file.

I did this by auditctl -a exit,always -F euid=0 -S execve but it logs all the system calls. Is there anyway to filter it? — user2314946
– user2314946, Commented Jul 26, 2016 at 12:20

user2314946 · Accepted Answer · 2016-07-27 09:52:59Z

auditctl -a exit,always -S execve did the job for me. But it creates too many logs so figuring how to remove the logs created by background process

Collectives™ on Stack Overflow

Auditing device files using auditcl daemon

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related