This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
система_linux_auditing [2016/08/01 16:36] val [Настройка правил аудита событий] |
система_linux_auditing [2024/05/22 16:28] (current) val [Настройка правил аудита событий] |
||
---|---|---|---|
Line 15: | Line 15: | ||
# auditctl -w /etc/passwd -p rwa -k passwords-files | # auditctl -w /etc/passwd -p rwa -k passwords-files | ||
# auditctl -w /etc/shadow -p rwa -k passwords-files | # auditctl -w /etc/shadow -p rwa -k passwords-files | ||
+ | |||
+ | # auditctl -l | ||
# cat /etc/audit/audit.rules | # cat /etc/audit/audit.rules | ||
+ | ubuntu24/debian12# /etc/audit/rules.d/audit.rules | ||
</code><code> | </code><code> | ||
... | ... | ||
Line 39: | Line 42: | ||
# ausearch -k passwords-files | # ausearch -k passwords-files | ||
- | |||
- | # ausearch -f /etc/passwd -i | ||
</code> | </code> |