Mastering Linux Security and Hardening - Second Edition

Hands-on lab – using auditd

In this lab, you'll practice using the features of auditd. Let's get started:

1. For Ubuntu only, install auditd:

sudo apt updatesudo apt install auditd

2. View the rules that are currently in effect:

sudo auditctl -l

3. From the command line, create a temporary rule that audits the /etc/passwd file for changes. Verify that the rule is in effect:

sudo auditctl -w /etc/passwd -p wa -k passwd_changessudo auditctl -l

Create a user account for Lionel. On Ubuntu, do the following:

sudo adduser lionel

On CentOS, do the following:

sudo useradd lionelsudo passwd lionel

4. Search for audit messages regarding any changes to the passwd file:

sudo ausearch -i -k passwd_changessudo aureport -i -k | grep 'passwd_changes'

5. Log out ...