CentOS7日志审计

最新推荐文章于 2024-08-09 16:47:25 发布
最新推荐文章于 2024-08-09 16:47:25 发布
阅读量1.2w 收藏 15
点赞数 5
分类专栏： linux学习 文章标签： audit 审计

写在前面的话: 最近公司在做等保,其中有审计的内容,因为第一次接触,所以在此粘贴在网上查找的各种资料,以作记录.

目录

一、用户空间审计系统简介

二、auditd配置文件

三、配置审计规则

四、审计日志内容

五、使用ausearch搜索审计日志

六、使用aureport查看审计报告

一、用户空间审计系统简介

Linux 内核有用日志记录事件的能力，包括记录系统调用和文件访问。管理员可以检查这些日志，确定是否存在安全漏洞（如多次失败的登录尝试，或者用户对系统文件不成功的访问）。

Linux 用户空间审计系统由 auditd、audispd、auditctl、autrace、ausearch 和 aureport 等应用程序组成。下面依次说明：

  • auditctl：即时控制审计守护进程的行为的工具，如添加规则等。
  • auditd：audit 守护进程负责把内核产生的信息写入到硬盘上，这些信息由应用程序和系统活动触发产生。用户空间审计系统通过 auditd 后台进程接收内核审计系统传送来的审计信息，将信息写入到 /var/log/audit/audit.log。
  • aureport：查看和生成审计报告的工具。
  • ausearch：查找审计事件的工具
  • auditspd：转发事件通知给其他应用程序，而不是写入到审计日志文件中。
  • autrace：一个用于跟踪进程的命令。

audit和syslog日志系统的关系

audit 主要用来记录安全信息，用于对系统安全事件的追溯，而 syslog 用来记录系统信息，如硬件警报和软件日志等。syslog 属于应用层，没办法记录太多信息，audit 用来记录内核信息，包括文件的读写，权限的改变等。

二、auditd配置文件

vi /etc/audit/auditd.conf

# 是否记录本地事件，如果设为no，只记录来自网络的事件
local_events = yes
write_logs = yes
# 日志文件
log_file = /var/log/audit/audit.log
log_group = root
log_format = RAW
# 日志文件刷新方式，可选的选项有：
# NONE：不做特别处理
# INCREMENTAL：用freq选项的值确定多长时间发生一次向磁盘的刷新
# DATA：审计数据和日志文件是同步的
# SYNC：写日志文件时，数据和元数据是同步的
flush = INCREMENTAL_ASYNC
freq = 50
# 日志文件最大8MB
max_log_file = 8
# 日志文件数量
num_logs = 5
# 进程优先级（-4），ps axl | grep auditd 可查
priority_boost = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
# 当log文件达到max_log_file设定大小后的动作。可选的动作有：
# IGNORE：忽略max_log_file设置的限制，继续写log文件
# SYSLOG：向syslog中写入一条warning
# SUSPEND：auditd不再写log文件，但是auditd继续运行
# ROTATE：分多个log文件，一个log文件达到上限后在创建一个新的不同名字的log文件
max_log_file_action = ROTATE
# log_file文件所在的分区空闲空间少于这个设定的值时，触发相应的动作，单位是MB
space_left = 75
# space_left设定被触发时的动作。可选动作有：
# IGNORE, SYSLOG, SUSPEND：与前面max_log_file_action相似
# SINGLE：audit进程会将系统模式变为单用户模式
# HALT：audit进程将会触发系统关机
space_left_action = SYSLOG
verify_email = yes
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
# 磁盘满后触发的动作
disk_full_action = SUSPEND
# 磁盘错误触发的动作
disk_error_action = SUSPEND
use_libwrap = yes
##tcp_listen_port = 60
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key
distribute_network = no

三、配置审计规则

auditctl命令可以控制审计系统的基本功能、设定规则等，但为了定义重启后一直有效的审计规则，需要把规则定义到/etc/audit/rules.d/目录下，重启auditd时，/etc/audit/rules.d/目录下所有文件的规则会合并到/etc/audit/audit.rules。

预配置规则文件

在/usr/share/doc/audit-{version}/rules/目录下，audit根据不同的标准提供了一组预配置规则文件：

  • nispom.rules — 审计规则配置符合《国家行业安全程序操作运行指南》的第八章中详细说明的要求。
  • pci-dss-v31.rules - 审计规则配置满足第三方支付行业所设定的要求。
  • stig.rules — 审计规则配置满足由STIG（安全技术实施指南）所设定的要求。

如配置为nispom规则：

cp /usr/share/doc/audit-2.8.4/rules/10-base-config.rules /usr/share/doc/audit-2.8.4/rules/30-nispom.rules /usr/share/doc/audit-2.8.4/rules/99-finalize.rules /etc/audit/rules.d/

重启auditd：

service auditd restart

四、审计日志内容

type=SYSCALL msg=audit(1557427974.683:2260): arch=c000003e syscall=257 success=yes exit=3 a0=ffffffffffffff9c a1=e61320 a2=90800 a3=0 items=1 ppid=31275 pid=4114 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=113 comm="bash" exe="/usr/bin/bash" key="audit-logs"
type=CWD msg=audit(1557427974.683:2260): cwd="/etc/audit"
type=PATH msg=audit(1557427974.683:2260): item=0 name="/var/log/audit/" inode=101477489 dev=fc:00 mode=040700 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PROCTITLE msg=audit(1557427974.683:2260): proctitle="bash"

事件分析：

  • type=SYSCALL

记录类型，可以到RedHat网站查询所有类型和说明：

B.2. AUDIT RECORD TYPES

Table B.2, “Record Types” lists all currently-supported types of Audit records. The event type is specified in the type= field at the beginning of every Audit record.

Table B.2. Record Types

Event TypeExplanation
ADD_GROUPTriggered when a user-space group is added.
ADD_USERTriggered when a user-space user account is added.
ANOM_ABEND[a]Triggered when a processes ends abnormally (with a signal that could cause a core dump, if enabled).
ANOM_ACCESS_FS[a]Triggered when a file or a directory access ends abnormally.
ANOM_ADD_ACCT[a]Triggered when a user-space account addition ends abnormally.
ANOM_AMTU_FAIL[a]Triggered when a failure of the Abstract Machine Test Utility (AMTU) is detected.
ANOM_CRYPTO_FAIL[a]Triggered when a failure in the cryptographic system is detected.
ANOM_DEL_ACCT[a]Triggered when a user-space account deletion ends abnormally.
ANOM_EXEC[a]Triggered when an execution of a file ends abnormally.
ANOM_LOGIN_ACCT[a]Triggered when an account login attempt ends abnormally.
ANOM_LOGIN_FAILURES[a]Triggered when the limit of failed login attempts is reached.
ANOM_LOGIN_LOCATION[a]Triggered when a login attempt is made from a forbidden location.
ANOM_LOGIN_SESSIONS[a]Triggered when a login attempt reaches the maximum amount of concurrent sessions.
ANOM_LOGIN_TIME[a]Triggered when a login attempt is made at a time when it is prevented by, for example, pam_time.
ANOM_MAX_DAC[a]Triggered when the maximum amount of Discretionary Access Control (DAC) failures is reached.
ANOM_MAX_MAC[a]Triggered when the maximum amount of Mandatory Access Control (MAC) failures is reached.
ANOM_MK_EXEC[a]Triggered when a file is made executable.
ANOM_MOD_ACCT[a]Triggered when a user-space account modification ends abnormally.
ANOM_PROMISCUOUS[a]Triggered when a device enables or disables promiscuous mode.
ANOM_RBAC_FAIL[a]Triggered when a Role-Based Access Control (RBAC) self-test failure is detected.
ANOM_RBAC_INTEGRITY_FAIL[a]Triggered when a Role-Based Access Control (RBAC) file integrity test failure is detected.
ANOM_ROOT_TRANS[a]Triggered when a user becomes root.
AVCTriggered to record an SELinux permission check.
AVC_PATHTriggered to record the dentry and vfsmount pair when an SELinux permission check occurs.
BPRM_FCAPSTriggered when a user executes a program with a file system capability.
CAPSETTriggered to record any changes in process-based capabilities.
CHGRP_IDTriggered when a user-space group ID is changed.
CHUSER_IDTriggered when a user-space user ID is changed.
CONFIG_CHANGETriggered when the Audit system configuration is modified.
CRED_ACQTriggered when a user acquires user-space credentials.
CRED_DISPTriggered when a user disposes of user-space credentials.
CRED_REFRTriggered when a user refreshes their user-space credentials.
CRYPTO_FAILURE_USERTriggered when a decrypt, encrypt, or randomize cryptographic operation fails.
CRYPTO_KEY_USERTriggered to record the cryptographic key identifier used for cryptographic purposes.
CRYPTO_LOGINTriggered when a cryptographic officer login attempt is detected.
CRYPTO_LOGOUTTriggered when a crypto officer logout attempt is detected.
CRYPTO_PARAM_CHANGE_USERTriggered when a change in a cryptographic parameter is detected.
CRYPTO_REPLAY_USERTriggered when a replay attack is detected.
CRYPTO_SESSIONTriggered to record parameters set during a TLS session establishment.
CRYPTO_TEST_USERTriggered to record cryptographic test results as required by the FIPS-140 standard.
CWDTriggered to record the current working directory.
DAC_CHECKTriggered to record DAC check results.
DAEMON_ABORTTriggered when a daemon is stopped due to an error.
DAEMON_ACCEPTTriggered when the auditd daemon accepts a remote connection.
DAEMON_CLOSETriggered when the auditd daemon closes a remote connection.
DAEMON_CONFIGTriggered when a daemon configuration change is detected.
DAEMON_ENDTriggered when a daemon is successfully stopped.
DAEMON_RESUMETriggered when the auditd daemon resumes logging.
DAEMON_ROTATETriggered when the auditd daemon rotates the Audit log files.
DAEMON_STARTTriggered when the auditd daemon is started.
DEL_GROUPTriggered when a user-space group is deleted
DEL_USERTriggered when a user-space user is deleted
DEV_ALLOCTriggered when a device is allocated.
DEV_DEALLOCTriggered when a device is deallocated.
EOETriggered to record the end of a multi-record event.
EXECVETriggered to record arguments of the execve(2) system call.
FD_PAIRTriggered to record the use of the pipe and socketpair system calls.
FS_RELABELTriggered when a file system relabel operation is detected.
GRP_AUTHTriggered when a group password is used to authenticate against a user-space group.
INTEGRITY_DATA[b]Triggered to record a data integrity verification event run by the kernel.
INTEGRITY_HASH[b]Triggered to record a hash type integrity verification event run by the kernel.
INTEGRITY_METADATA[b]Triggered to record a metadata integrity verification event run by the kernel.
INTEGRITY_PCR[b]Triggered to record Platform Configuration Register (PCR) invalidation messages.
INTEGRITY_RULE[b]Triggered to record a policy rule.
INTEGRITY_STATUS[b]Triggered to record the status of integrity verification.
IPCTriggered to record information about a Inter-Process Communication object referenced by a system call.
IPC_SET_PERMTriggered to record information about new values set by an IPC_SET control operation on an IPC object.
KERNELTriggered to record the initialization of the Audit system.
KERNEL_OTHERTriggered to record information from third-party kernel modules.
LABEL_LEVEL_CHANGETriggered when an object's level label is modified.
LABEL_OVERRIDETriggered when an administrator overrides an object's level label.
LOGINTriggered to record relevant login information when a user log in to access the system.
MAC_CIPSOV4_ADDTriggered when a Commercial Internet Protocol Security Option (CIPSO) user adds a new Domain of Interpretation (DOI). Adding DOIs is a part of the packet labeling capabilities of the kernel provided by NetLabel.
MAC_CIPSOV4_DELTriggered when a CIPSO user deletes an existing DOI. Adding DOIs is a part of the packet labeling capabilities of the kernel provided by NetLabel.
MAC_CONFIG_CHANGETriggered when an SELinux Boolean value is changed.
MAC_IPSEC_EVENTTriggered to record information about an IPSec event, when one is detected, or when the IPSec configuration changes.
MAC_MAP_ADDTriggered when a new Linux Security Module (LSM) domain mapping is added. LSM domain mapping is a part of the packet labeling capabilities of the kernel provided by NetLabel.
MAC_MAP_DELTriggered when an existing LSM domain mapping is added. LSM domain mapping is a part of the packet labeling capabilities of the kernel provided by NetLabel.
MAC_POLICY_LOADTriggered when a SELinux policy file is loaded.
MAC_STATUSTriggered when the SELinux mode (enforcing, permissive, off) is changed.
MAC_UNLBL_ALLOWTriggered when unlabeled traffic is allowed when using the packet labeling capabilities of the kernel provided by NetLabel.
MAC_UNLBL_STCADDTriggered when a static label is added when using the packet labeling capabilities of the kernel provided by NetLabel.
MAC_UNLBL_STCDELTriggered when a static label is deleted when using the packet labeling capabilities of the kernel provided by NetLabel.
MMAPTriggered to record a file descriptor and flags of the mmap(2)system call.
MQ_GETSETATTRTriggered to record the mq_getattr(3) and mq_setattr(3)message queue attributes.
MQ_NOTIFYTriggered to record arguments of the mq_notify(3) system call.
MQ_OPENTriggered to record arguments of the mq_open(3) system call.
MQ_SENDRECVTriggered to record arguments of the mq_send(3) and mq_receive(3) system calls.
NETFILTER_CFGTriggered when Netfilter chain modifications are detected.
NETFILTER_PKTTriggered to record packets traversing Netfilter chains.
OBJ_PIDTriggered to record information about a process to which a signal is sent.
PATHTriggered to record file name path information.
RESP_ACCT_LOCK[c]Triggered when a user account is locked.
RESP_ACCT_LOCK_TIMED[c]Triggered when a user account is locked for a specified period of time.
RESP_ACCT_REMOTE[c]Triggered when a user account is locked from a remote session.
RESP_ACCT_UNLOCK_TIMED[c]Triggered when a user account is unlocked after a configured period of time.
RESP_ALERT[c]Triggered when an alert email is sent.
RESP_ANOMALY[c]Triggered when an anomaly was not acted upon.
RESP_EXEC[c]Triggered when an intrusion detection program responds to a threat originating from the execution of a program.
RESP_HALT[c]Triggered when the system is shut down.
RESP_KILL_PROC[c]Triggered when a process is terminated.
RESP_SEBOOL[c]Triggered when an SELinux Boolean value is set.
RESP_SINGLE[c]Triggered when the system is put into single-user mode.
RESP_TERM_ACCESS[c]Triggered when a session is terminated.
RESP_TERM_LOCK[c]Triggered when a terminal is locked.
ROLE_ASSIGNTriggered when an administrator assigns a user to an SELinux role.
ROLE_MODIFYTriggered when an administrator modifies an SELinux role.
ROLE_REMOVETriggered when an administrator removes a user from an SELinux role.
SELINUX_ERRTriggered when an internal SELinux error is detected.
SERVICE_STARTTriggered when a service is started.
SERVICE_STOPTriggered when a service is stopped.
SOCKADDRTriggered to record a socket address.
SOCKETCALLTriggered to record arguments of the sys_socketcall system call (used to multiplex many socket-related system calls).
SYSCALLTriggered to record a system call to the kernel.
SYSTEM_BOOTTriggered when the system is booted up.
SYSTEM_RUNLEVELTriggered when the system's run level is changed.
SYSTEM_SHUTDOWNTriggered when the system is shut down.
TESTTriggered to record the success value of a test message.
TRUSTED_APPThe record of this type can be used by third party application that require auditing.
TTYTriggered when TTY input was sent to an administrative process.
USER_ACCTTriggered when a user-space user account is modified.
USER_AUTHTriggered when a user-space authentication attempt is detected.
USER_AVCTriggered when a user-space AVC message is generated.
USER_CHAUTHTOKTriggered when a user account attribute is modified.
USER_CMDTriggered when a user-space shell command is executed.
USER_ENDTriggered when a user-space session is terminated.
USER_ERRTriggered when a user account state error is detected.
USER_LABELED_EXPORTTriggered when an object is exported with an SELinux label.
USER_LOGINTriggered when a user logs in.
USER_LOGOUTTriggered when a user logs out.
USER_MAC_POLICY_LOADTriggered when a user-space daemon loads an SELinux policy.
USER_MGMTTriggered to record user-space management data.
USER_ROLE_CHANGETriggered when a user's SELinux role is changed.
USER_SELINUX_ERRTriggered when a user-space SELinux error is detected.
USER_STARTTriggered when a user-space session is started.
USER_TTYTriggered when an explanatory message about TTY input to an administrative process is sent from user-space.
USER_UNLABELED_EXPORTTriggered when an object is exported without SELinux label.
USYS_CONFIGTriggered when a user-space system configuration change is detected.
VIRT_CONTROLTriggered when a virtual machine is started, paused, or stopped.
VIRT_MACHINE_IDTriggered to record the binding of a label to a virtual machine.
VIRT_RESOURCETriggered to record resource assignment of a virtual machine.

[a] All Audit event types prepended with ANOM are intended to be processed by an intrusion detection program.

[b] This event type is related to the Integrity Measurement Architecture (IMA), which functions best with a Trusted Platform Module (TPM) chip.

[c] All Audit event types prepended with RESP are intended responses of an intrusion detection system in case it detects malicious activity on the system.

  • msg=audit(1557427974.683:2260)

括号中为时间缀和特殊ID，如果多种记录生成为相同审核事件的一部分，那么它们可以共享相同的时间戳和ID。

  • 后面为Kernel或用户空间提供的不同事件（name=value组）。

五、使用ausearch搜索审计日志

如：搜索登录失败的日志信息：

ausearch --message USER_LOGIN --success no --interpret

搜索内容如下：

----
type=USER_LOGIN msg=audit(2019年05月09日 09:58:07.647:537) : pid=6772 uid=root auid=unset ses=unset msg='op=login acct=root exe=/usr/sbin/sshd hostname=? addr=192.168.9.165 terminal=ssh res=failed'
----
type=USER_LOGIN msg=audit(2019年05月10日 03:06:53.549:2317) : pid=5003 uid=root auid=unset ses=unset msg='op=login acct=root exe=/usr/sbin/sshd hostname=? addr=192.168.9.166 terminal=ssh res=failed'

六、使用aureport查看审计报告

可以直接使用aureport命令生成概要报告，内容如下：

Summary Report
======================
Range of time in logs: 1970年01月01日 08:00:00.000 - 2019年05月10日 03:11:46.045
Selected time for report: 1970年01月01日 08:00:00 - 2019年05月10日 03:11:46.045
Number of changes in configuration: 79
Number of changes to accounts, groups, or roles: 0
Number of logins: 2
Number of failed logins: 3
Number of authentications: 7
Number of failed authentications: 16
Number of users: 3
Number of terminals: 8
Number of host names: 4
Number of executables: 14
Number of commands: 10
Number of files: 13
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 812
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 55
Number of integrity events: 0
Number of virt events: 0
Number of keys: 9
Number of process IDs: 950
Number of events: 1935

可以通过传入参数生成不同类型的报告。

 

复制于(http://blog.gopersist.com/2019/05/10/centos7-audit/index.html)

ezbuy
关注
专栏目录
centos 日志审计_CentOS7日志审计
weixin_32999397的博客
01-17 2060
一、用户空间审计系统简介Linux 内核有用日志记录事件的能力，包括记录系统调用和文件访问。管理员可以检查这些日志，确定是否存在安全漏洞(如多次失败的登录尝试，或者用户对系统文件不成功的访问)。Linux 用户空间审计系统由 auditd、audispd、auditctl、autrace、ausearch 和 aureport 等应用程序组成。下面依次说明：auditctl：即时控制审计守护进程的...
centos 日志审计_CentOS7下安全审计工具Auditd的简单使用
weixin_30143813的博客
01-17 3539
auditdauditd是Linux审计系统的用户空间组件，它负责将审计记录写入磁盘。查看日志使用ausearch或aureport实用程序完成。使用auditctl实用程序配置审核系统或加载规则。在auditd启动期间，/etc/audit/audit.rules 中的审计规则由auditctl读取并加载到内核中。或者还有一个 augenrules程序，读取/etc/audit/rules.d...
centos7.6三权分立+安全审计
最新发布
大新新大浩浩的博客
08-09 542
centos7.6三权分立+安全审计
ELK
流风雨情的博客
11-14 3416
ELK是Elasticsearch、Logstash、Kibana的简称，这三者是核心套件，但并非全部。 Elasticsearch是实时全文搜索和分析引擎，提供搜集、分析、存储数据三大功能；是一套开放REST和JAVA API等结构提供高效搜索功能，可扩展的分布式系统。它构建于Apache Lucene搜索引擎库之上。 Logstash是一个用来搜集、分析、过滤日志的工具。它支持几乎任何类型的日...
Cenos7 登录安全设置和审计设置
zongzhibin117的博客
02-24 1567
Cenos7 登录安全设置和审计设置
CentOS 7 下审计服务安装配置
老实人张大傻
08-24 2751
文章目录Audit 服务安装Audit 启动 && 开机启动配置 Audit 规则记录系统的日期和时间的修改记录用户和组的修改的事件记录网络环境修改时间记录登录和登出事件记录会话启动事件监视对文件权限、属性、所有权和组的更改记录未授权文件访问尝试收集成功挂载磁盘事件收集用户的文件删除事件收集对系统管理范围（sudoers）的更改收集内核模块加载和卸载收集使用特权命令参考 Audit 服务安装 [root@demo ~]# yum -y install audit audit-libs-dev
centos7审计所有用户执行命令
noob9527的博客
02-16 869
centos7审计所有用户执行命令
centos linux系统日志分析,CentOS 7日志分析与安全+日志服务器rsyslogd的搭建与使用...
weixin_28836989的博客
05-01 1014
一、什么是日志日志用于记录系统、程序运行中发生的各种事件。通过日志可以排查解决故障，日志也是审计的基础。日志又分为系统日志(由系统服务rsyslog进行统一管理)、用户日志(记录用户登录登出系统的信息)以及程序日志(最为主要的日志，由各应用产生，如apache日志、nginx日志等)。二、常见日志介绍内核及公共消息日志：/var/log/messages计划任务日志：/var/log/cron系统...
centos 日志审计_centos6 配置sudo命令日志审计
weixin_33479446的博客
01-17 840
配置sudo命令日志审计说明：所谓sudo命令日志审计，并不记录普通用户的普通操作，而是记录那些执行sudo命令的用户的操作。项目实战：服务器日志审计项目提出与实施权限方案实施后，权限得到了细化控制，接下来进一步实施以地所有用户日志记录方案。通过sudo和syslog(rsyslog)配合实现对所有用户进行日志审计并将记录集中管理(发送到中心日志服务器)、实施后，让所有运维和开发的所有执行的sud...
CentOS7 利用rsyslog建立日志备份（同步）服务
ElsonHY的博客
11-26 2962
CentOS7 利用rsyslog建立日志备份（同步）服务前言0x01 服务端配置0x02 客户端配置0x03 测试0x04 总结 前言 日志是查看系统运行情况的一个重要部分，在应急响应中，服务器的日志文件就扮演了一个特别重要的作用，管理员根据日志可以判断一些恶意的攻击行为，以此来将一些IP拉入黑名单或者对攻击进行溯源等等。为防止日志被恶意删除的行为，日志的备份就显得特别重要。 0x01 服务端配置 服务端：负责接收其他客户端发来的日志，并做好备份保存。 打开rsyslog的配置文件。 vim /et
CentOS 7 安全加固、检测、审计
热门推荐
静静是我女朋友
11-07 1万+
RKHunter：检测Rootkit RKHunter 传送门：http://rkhunter.sourceforge.net/ Root Kit 详解：http://linux.vbird.org/linux_security/0420rkhunter.phpRKHunter 安装 [root@linuxprobe ~]# yum --enablerepo=epel -y instal
CentOS历史命令查询、用户操作审计
zywhehe的博客
05-23 2002
CentOS历史命令查询、用户操作审计
centos 启用远程日志功能_CentOS7下搭建Rsyslog Server记录远程主机系统日志
weixin_39983223的博客
01-26 829
rsyslog是一个快速处理收集系统日志的开源程序，提供了高性能、安全功能和模块化设计。rsyslog 是syslog 的升级版，它将多种来源输入输出转换结果到目的地， rsyslog被广泛用于Linux系统以通过TCP/UDP协议转发或接收日志消息。 rsyslog守护进程可以被配置成两种环境，一种是配置成日志收集服务器，rsyslog进程可以从网络中收集其它主机上的日志数据，这些主机会将日...
Linux日志权限记录6个月,linux权限集中管理和行为日志审计
weixin_42321496的博客
05-02 2534
useradd -g -u -c -s -d -G -M -D改变默认属性userdel -rusermodgroupaddgroupdelpasswd --stdinchage 修改密码过期属性的 -l -Esu - -c 执行完退回来sudo 普通用户可以拥有root的权限visudonewgrpidw who las...
centos 日志审计_Linux\CentOS中auditd安全审计工具的使用
weixin_32943417的博客
01-17 1211
介绍Auditd工具可以帮助运维人员审计Linux。这个工具在大多数Linux操作系统中是默认安装的，是Linux审计系统中用户空间的一个组件，其负责将审计记录写入磁盘。安装$apt-getinstallauditdor$yum-yinstallauditauditd-libs相关命令auditctl : 即时控制审计守护进程的行为的工具，比如如添加规则等等$sudoaudit...
linux 7 防火墙 开启日志,centos7搭建syslog服务统一收集服务器、waf、防火墙、交换机及iis日志...
weixin_30977281的博客
05-04 1533
由于等保的要求，日志必须留存180天，关键是安全设备、服务器、IIS的流量日志、访问日志和攻击日志等，由于设施过于分散管理过于复杂，其中部分设备由于并未配置硬盘存储，本地留存能力有限。需要架设一台统一的日志服务器，集中存储和备份各类关键设施的日志一、搭建并测试和运行rsyslog1、centos7上安装rsyslogyuminstallrsyslog2、关闭防火墙systemctlstop ...
audit审计日志分析
龙在江湖
08-29 3122
记录部分 名称 描述 类型= AVC 日志类型 仅在audit.log文件中;它通知用户这是什么类型的审计日志类型。所以在我们的例子中，它是一个AVC日志条目 味精=审计（1363289005.532：184） 时间戳 自纪元以来以秒为单位的时间戳，表示自1970年1月1日以来的秒数。您可以使用日期-d @后跟数字将其转换为更易于阅读的格式，如下所示：...
CentOS 7 查看配置命令
weixin_43465752的博客
06-16 1291
适用CentOS 7 或者 Redhat 7。
centos 7核心版优化
ELF Project
04-10 2144
1、禁用不需要的服务 systemctl disable auditd avahi-daemon firewalld kdumo tuned chkconfig iprdump off chkconfig iprinit off chkconfig iprupdate off chkconfig network off 2、关闭selinux setenforce
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值