0

I'm struggling with the following task for AuditD

/etc/passwd should be monitored for any access doesn't matter if a cat or sudo cat is used...ok, easy. BUT I should also prevent auditd to log any other sudo commands that are not used to access /etc/passwd

I'm totally lost at this point. Logging each sudo command by -S execve is easy but only for sudo /etc/passwd gives me headaches.

Improve this question
4
  • I don't understand that problem. It would be easier if you added to the question what you've already tried doing, which command you're using. For instance, to monitor any processes that accesses a file you can run auditctl -w /etc/passwd -p rwa, but I don't know if you've already tried that and what's missing. This command also shows the pid and process name that accessed the file. Also, I don't understand how sudo is related, since you say "doesn't matter if a cat or sudo cat". Commented Oct 25, 2022 at 9:55
  • Thanks for your response. The filewatch you mentioned was the easy part. What I need now is this: A user who issues this "sudo vim /etc/passwd" or "cat /etc/passwd" etc. shoud be logged...if a user issues a sudo command like this "sudo vim somefile" ...nothing should be logged. Commented Oct 25, 2022 at 10:05
  • You can see in the audit log this information in the auid field. See here: Records the Audit user ID. This ID is assigned to a user upon login and is inherited by every process even when the user's identity changes (for example, by switching user accounts with su -john). Commented Oct 25, 2022 at 11:35
  • Given that /etc/passwd will be accessed every time a user runs ps -fe, ls -l, top, etc, do you really want to scan through all of those logs? Commented Oct 25, 2022 at 12:27

1 Answer 1

Reset to default
0

The auid field in auditlog shows you exactly that. You don't need to audit execve calls for that.

From RHEL Audit System Reference:

auid - Records the Audit user ID. This ID is assigned to a user upon login and is inherited by every process even when the user's identity changes (for example, by switching user accounts with su -john).

For instance, in the following line you could see that the uid was root, but the auid (the original user that ran sudo) was john.

$ ausearch -i -k passwd |grep cat type=SYSCALL msg=audit(10/25/22 14:49:05.149:376) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x7fffffffe268 a2=O_RDONLY a3=0x0 items=1 ppid=10413 pid=10418 auid=john uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts8 ses=21750 comm=cat exe=/usr/bin/cat subj==unconfined key=passwd

In case you missed, the relevant part is: auid=john uid=root

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.