On Linux servers, security auditing is crucial, especially for protecting critical configuration files from unauthorized changes. In this regard, auditd is a powerful auditing mechanism provided by the Linux kernel. It records file changes, system calls, and user actions in detail. This guide will walk you through using auditd to monitor file changes step by step.
What is Auditd and Why is it Important?
auditd is a service that collects and manages audit logs on Linux systems. It is ideal for monitoring changes to sensitive files such as /etc/passwd, /etc/shadow, and /etc/ssh/sshd_config. If an attacker modifies these files, auditd allows you to detect the incident, see who made the change, when, and how. This enables early detection of security breaches.
Installation and Initial Configuration
On most Linux distributions, auditd is installed by default. If not, you can install it with the following commands:
sudo apt install auditd audispd-plugins # For Debian/Ubuntu
sudo yum install audit audit-libs # For RHEL/CentOS
After installation, start the service and enable it to run automatically on boot:
sudo systemctl enable auditd
sudo systemctl start auditd
Now auditd is running. The main configuration file is /etc/audit/auditd.conf. You can adjust settings such as log size and retention period here.
File Change Monitoring Rules
Add rules as .rules files under the /etc/audit/rules.d/ directory. For example, to monitor changes to /etc/passwd:
sudo nano /etc/audit/rules.d/watch-passwd.rules
Write the following rule inside:
-w /etc/passwd -p wa -k passwd_changes
In this rule: -w specifies the file to watch, -p wa monitors write and attribute changes, and -k sets a key phrase. Similarly, for /etc/shadow:
-w /etc/shadow -p wa -k shadow_changes
To load the rules, restart auditd:
sudo systemctl restart auditd
You can also monitor an entire directory. For example:
-w /etc/ssh -p wa -k ssh_config_changes
Viewing and Analyzing Logs
Logs are stored in /var/log/audit/audit.log. You can query them using ausearch and aureport. To view records related to the passwd_changes key:
sudo ausearch -k passwd_changes
The output is very detailed; each event includes type (syscall), user (uid), process (pid), timestamp, and result (success/fail). Example line:
type=SYSCALL msg=audit(1609459200.123:456): arch=c000003e syscall=2 success=yes exit=0 ... uid=1000 comm="vim" ... key="passwd_changes"
This indicates that user with UID 1000 opened the file with vim. You can generate summary reports with aureport:
sudo aureport -k -i
Example Scenarios
1. Unauthorized SSH Configuration Change: If an attacker modifies /etc/ssh/sshd_config to allow root login, auditd immediately logs the change. Use ausearch -k ssh_config_changes to investigate.
2. Monitoring System Binaries: Critical paths like /usr/bin or /usr/sbin can also be monitored. For example:
-w /usr/bin -p wa -k binary_changes
However, this may generate a large number of logs; it is more sensible to monitor only specific files.
3. Log Rotation and Retention: In the auditd.conf file, set max_log_file and num_logs parameters to control log size and the number of files retained. For example, to keep 5 log files of 50 MB each:
max_log_file = 50
num_logs = 5
Conclusion
auditd is an indispensable tool for monitoring file changes on Linux servers. With the right rules, you can detect attacks early and provide the necessary evidence for forensic analysis. Remember, logs need to be reviewed regularly. By setting up automatic alerting systems (e.g., forwarding to syslog via audispd), you can make the process more efficient. HostingServer.com.tr recommends using auditd to enhance your server security.