A lowest-cost implementation of the Linux Audit under Devops

• 

  A fast and extensible generate auditd service rules devops tool

name: gen-audit-rules

Linux generate auditd service rules tools

In daily programming, I often use tools that need to be configured with audit functions but do not want to maintain too complex contacts to increase additional costs. Moreover, most tools are not flexible enough to meet some customized needs and business scenarios. Therefore, it is considered to use most of the basic distribution versions of all systems Python to write this project. At the beginning of writing, two points were considered.

1. it is flexible and extensible without introducing additional tools;
2. flexibly configure lightweight modularity to facilitate 20 development and rapid implementation of business scenarios of different projects.

Configuration rules (infinite nodes)

# custom rule configuration reference instance (conf/audit_rules_conf.json) :

{
"web01":{
"/data/www/web":"-p rwa",
"/data/www/vendor":"-p rwa"
},
"web02":{
"/data/www/web":"-p rwa",
"/data/www/vendor":"-p rwa"
},
"web03":{
"/data/www/web":"-p rwa",
"/data/www/vendor":"-p rwa"
},
"web0N":{
"/data/www/web":"-p rwa",
"/data/www/vendor":"-p rwa"
},
"system":{
"/etc/passwd":"-k PASSWD",
"/etc/my.conf":"-k PASSWD"
}
...
}

Composition of audit rules (consolidation)

[system default rules] The conf/audit.Rules. Default

[custom rules, infinite nodes] The conf/audit_rules_conf.Json

Create rule instances (rules default -w)

APP NAME Audit Rules Created By DataTime: 2019/01/01 00:00:00

# audit rule block: web

-w /data/WWW/web -p rwa
-w /data/WWW/vendor -p rwa

Rule block: # audit system
-w /etc/my.cnf -k PASSWD
-w /etc/passwd -k passwd

Built rules file path: gen_audit_rules/audit.rules

centos 6.x path: /etc/audit/audit.rules

centos 7.x path: /etc/audit/rules.d/audit.rules

Common command tools

Auditctl: a tool for controlling the behavior of the audit daemon in real time, such as adding rules.
Aureport: a tool for viewing and generating audit reports.
Ausearch: a tool for finding audit events.
Auditspd: forwards event notifications to other applications instead of writing them to the audit log file.
Autrace: a command used to trace a process.

# the conf file:

/etc/auditd.conf: the configuration file for the auditd tool.
/etc/audit/audit.rules: files that record audit rules.

Built With

• linux
• python