Mastering Linux Security and Hardening

Using predefined rules sets

In the /usr/share/doc/audit-version_number/ directory of your CentOS machine, you'll see some premade rule sets for different scenarios. Once you install auditd on Ubuntu, you'll have audit rules for it too, but the location is different for Ubuntu 16.04 and Ubuntu 17.10.  On Ubuntu 16.04, the rules are in the /usr/share/doc/auditd/examples/ directory. On Ubuntu 17.10, they're in the /usr/share/doc/auditd/examples/rules/ directory. In any case, some of the rule sets are common among all three of these distros. Let's look on the CentOS machine to see what we have there:

[donnie@localhost rules]$ pwd/usr/share/doc/audit-2.7.6/rules[donnie@localhost rules]$ ls -ltotal 96-rw-r--r--. 1 root root 163 Aug 4 17:29 10-base-config.rules ...