auditctl

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

The kernel audit system, with the auditd daemon, writes detailed records to /var/log/audit/audit.log: file access (watches), system calls, logins, sudo, SELinux denials. auditctl adds and lists rules at runtime; permanent rules go in /etc/audit/rules.d/*.rules and are loaded by augenrules. ausearch and aureport read the log.

Audit rules are required by CIS, STIG and PCI-DSS (for example: log changes to /etc/passwd, /etc/sudoers and time settings).

طريقة الكتابة

auditctl -w PATH -p rwxa -k KEY
auditctl -a always,exit -F arch=b64 -S SYSCALL [-F ...] -k KEY
auditctl -l | -s | -D

الأجزاء الرئيسية

Commands

-l: List the loaded rules.
-s: Status (enabled, lost events, backlog).
-w PATH -p PERMS -k KEY: Watch a file or folder.
-W PATH: Remove a watch.
-a always, exit -S CALL: Add a syscall rule.
-D: Delete all rules.
-e 0|1|2: Disable / enable / lock (2 = no changes until reboot).

الخيارات 6

الأكثر استخدامًا

Rule parts

-p r|w|x|a: Read, write, execute, attribute change.
-k KEY: A key name to search for later.
-F arch=b64: 64-bit system calls (add a b32 rule too).
-F auid>=1000 -F auid!=unset: Only real users (login UID).
-F path=FILE / -F dir=DIR: Limit by path.
-F success=0: Only failed calls.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Status and rules
```
#auditctl -s
#auditctl -l
```

2Watch identity files

#auditctl -w /etc/passwd -p wa -k identity
#auditctl -w /etc/shadow -p wa -k identity
#auditctl -w /etc/sudoers -p wa -k sudoers
#auditctl -w /etc/sudoers.d/ -p wa -k sudoers

3Make the rules permanent

#cat /etc/audit/rules.d/50-identity.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/ssh/sshd_config -p wa -k sshd
#augenrules --load

4Log every command run by real users

#cat /etc/audit/rules.d/60-exec.rules
-a always,exit -F arch=b64 -S execve -F auid>=1000 -F auid!=unset -k user_cmds
-a always,exit -F arch=b32 -S execve -F auid>=1000 -F auid!=unset -k user_cmds

5Log failed file access (permission denied)

#auditctl -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -k access_denied

6Search by key

#ausearch -k identity -i --start today
#ausearch -k user_cmds -ua 1001 -i | tail -20

7Reports

#aureport --summary
#aureport -au --failed
#aureport -x --summary | head

8Lock the rules (production)

#cat /etc/audit/rules.d/99-finalize.rules
-e 2
#augenrules --load

9Use the CIS / STIG sample rules

#ls /usr/share/audit-rules/
#cp /usr/share/audit-rules/30-stig.rules /etc/audit/rules.d/ && augenrules --load

10Restart auditd the right way
```
#service auditd restart
```
systemctl restart auditd is refused; auditd must be restarted with service.

انتبه

Too many syscall rules slow the system and fill the disk; set log rotation in /etc/audit/auditd.conf.
With -e 2 you cannot change rules until reboot (good for production, bad while testing).
Send audit logs to a central system; a root attacker can delete local logs.

الملفات

/etc/audit/rules.d/*.rules: Permanent rules.
/etc/audit/audit.rules: Generated by augenrules (do not edit).
/etc/audit/auditd.conf: Daemon settings (size, rotation, disk-full action).
/var/log/audit/audit.log: The log.

نصائح للحفظ

Always use -k keys; they make ausearch fast and clear.

رموز الخروج

`0`	Success.
`1`	Error.

`auditctl`

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Commands

الخيارات 6

Rule parts

أمثلة 10

1Status and rules

2Watch identity files

3Make the rules permanent

4Log every command run by real users

5Log failed file access (permission denied)

6Search by key

7Reports

8Lock the rules (production)

9Use the CIS / STIG sample rules

10Restart auditd the right way

انتبه

الملفات

نصائح للحفظ

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Commands

الخيارات 6

Rule parts

أمثلة 10

1Status and rules

2Watch identity files

3Make the rules permanent

4Log every command run by real users

5Log failed file access (permission denied)

6Search by key

7Reports

8Lock the rules (production)

9Use the CIS / STIG sample rules

10Restart auditd the right way

انتبه

الملفات

نصائح للحفظ

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`auditctl`