How to use the audit log of a CentOS system to detect unauthorized access to the system

How to use the audit log of the CentOS system to monitor unauthorized access to the system

With the development of the Internet, network security issues have become increasingly prominent, and many system administrators have become increasingly concerned about system security. Pay attention to. As a commonly used open source operating system, CentOS's audit function can help system administrators monitor system security, especially for unauthorized access. This article will introduce how to use the audit log of the CentOS system to monitor unauthorized access to the system and provide code examples.

1. Turn on the audit log function
To use the audit log function of the CentOS system, you first need to ensure that the function is turned on. In the CentOS system, you can enable the audit log function by modifying the /etc/audit/auditd.conf file. You can use the following command to open the file:

sudo vi /etc/audit/auditd.conf

In the file, find the following two lines of code:

#local_events = yes
#write_logs = yes

Remove the comment symbols # before these two lines of code , modify it to the following form:

local_events = yes
write_logs = yes

Save and exit the file. Then restart the audit service through the following command:

sudo service auditd restart

2. Configure audit rules
After turning on the audit log function, you need to configure audit rules to monitor unauthorized access. Audit rules can be configured by modifying the /etc/audit/audit.rules file. You can use the following command to open the file:

sudo vi /etc/audit/audit.rules

In this file, you can add the following content as audit rules:

-a exit,always -F arch=b64 -S execve
-a exit,always -F arch=b32 -S execve

These two lines of rules will monitor all execution operations. If you only want to monitor a specific execution operation, you can use the following command:

-a exit,always -F arch=b64 -S specific_execve_syscall

where specific_execve_syscall is the system call name of the specific execution operation. This name can be modified according to specific needs. After adding the rules, save and exit the file.

3. View the audit log
When the system receives unauthorized access, the relevant information will be recorded in the audit log. You can use the following command to view the audit log:

sudo ausearch -ui 1000

where 1000 is the user ID, which can be modified according to the specific situation. You can use this command to view the audit log of a specific user. You can also use the following command to view all audit logs:

sudo ausearch

The above command will display all audit logs.

4. Enhance the audit log function
In order to better monitor unauthorized access, the audit log function can be further enhanced. You can configure more audit rules by modifying the /etc/audit/audit.rules file. The following are some commonly used audit rules:

1. Monitoring login and logout events:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

2. Monitoring file and directory change events:

-w /etc/passwd -p wa -k identity_changes
-w /etc/shadow -p wa -k identity_changes
-w /etc/group -p wa -k identity_changes
-w /etc/gshadow -p wa -k identity_changes
-w /etc/sudoers -p wa -k identity_changes
-w /etc/securetty -p wa -k identity_changes
-w /var/log/messages -p wa -k logfiles

3. Monitor reading events of sensitive files:

-w /etc/passwd -p rwa -k sensitive_files
-w /etc/shadow -p rwa -k sensitive_files
-w /etc/group -p rwa -k sensitive_files
-w /etc/gshadow -p rwa -k sensitive_files
-w /etc/sudoers -p rwa -k sensitive_files
-w /etc/securetty -p rwa -k sensitive_files

4. Summary
This article introduces how to use the audit log of the CentOS system to monitor unauthorized access to the system , and provides relevant code examples. By enabling the audit log function, configuring audit rules, and viewing audit logs, you can better monitor system security and prevent unauthorized access events. At the same time, by enhancing the audit log function, the security of the system can be further improved. System administrators can choose audit rules suitable for their own systems based on specific needs, and check audit logs regularly to detect and handle unauthorized access events in a timely manner to protect system security.

The above is the detailed content of How to use the audit log of a CentOS system to detect unauthorized access to the system. For more information, please follow other related articles on the PHP Chinese website!