This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
система_linux_auditing [2012/06/17 18:31] val |
система_linux_auditing [2013/11/26 10:43] val [Настройка правил аудита событий] |
||
---|---|---|---|
Line 1: | Line 1: | ||
====== Система Linux Auditing ====== | ====== Система Linux Auditing ====== | ||
- | [[http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html]] | + | * [[http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html]] |
+ | * [[http://www.xakep.ru/post/54897/]] | ||
+ | |||
+ | Сценарий: отслеживаем события чтения/записи/добавления в файлы passwd и shadow | ||
===== Установка и запуск системы аудита ===== | ===== Установка и запуск системы аудита ===== | ||
<code> | <code> | ||
Line 11: | Line 14: | ||
# auditctl -w /etc/passwd -p rwa -k passwords-files | # auditctl -w /etc/passwd -p rwa -k passwords-files | ||
+ | # auditctl -w /etc/shadow -p rwa -k passwords-files | ||
# cat /etc/audit/audit.rules | # cat /etc/audit/audit.rules | ||
</code><code> | </code><code> | ||
... | ... | ||
+ | -w /etc/passwd -p rwa -k passwords-files | ||
-w /etc/shadow -p rwa -k passwords-files | -w /etc/shadow -p rwa -k passwords-files | ||
</code><code> | </code><code> | ||
Line 22: | Line 27: | ||
===== Генерация событий ===== | ===== Генерация событий ===== | ||
<code> | <code> | ||
- | # touch /etc/passwd | + | user1$ touch /etc/passwd |
- | # cat /etc/shadow | + | user1$ cat /etc/shadow |
</code> | </code> | ||