AUDITD(8)

NAME
Auditd - Remote system logs auditing daemon

SYNOPSIS
auditd [-f file] [-M path] [-p [address:] port] [-t seconds] [-T seconds] [-l] [-d] [-v] [-q] [-h]

DESCRIPTION
Auditd daemon and audit(1) programs allow together remote system logs auditing. Auditd server runs usually on audited hosts and listens on a specified port waiting for an audit(1) client connection that runs, usually, on the auditor workstation. The options are as follows:

-f file
    Specifies the configuration file; the default is /etc/auditd.conf (see CONFIGURATION FILE FORMAT section below).

-M path
    Specifies the modules pathname; the default is /usr/local/lib/alat (see audit(1) for more information about modules).

-p [address:]port
    Specifies the listening address and port; the default address is 0.0.0.0 (all addresses) and port 9015.

-t sec
    Specifies the login timeout: once the connection is established the authentication process can't exceed sec seconds, otherwise the connection is closed; the default is 10 seconds. A value of 0 disables this feature.

-T sec
    Specifies the command timeout: once a connection is established and an auditor is logged in, he has sec seconds to enter a command, otherwise the connection is closed; the default is 120 seconds. A value of 0 disables this feature.

-l  Log each auditor session (commands and status).

-d  Log debug information.

-v  Verbose mode: it doesn't become a daemon and logs messages on standard output instead of syslog(3). It exits after one session.

-q  Quiet mode.

-h  Prints a help on standard error and exits.

Auditd reads its configuration file when starts up and whenever it receives a hangup (HUP) signal. The configuration values are set in the following order:

1.  Default values

2.  Configuration file values

3.  Command line values

Auditd creates the file /var/run/auditd.pid and stores its process id there. This can be used to terminate or reconfigure auditd.

CONFIGURATION FILE FORMAT
The auditd configuration file format consists of two column lines; the former specifies the option name and the other it's value. A line that begins with a ``#'' character is considered comment line and is not parsed. Options names are as follows:

ListenAddress
    Specifies the listening address; the default is 0.0.0.0 (all addresses).

Port
    Specifies the listening port; the default is 9015.

Timeout
    Specifies the login timeout in seconds; the default is 10.

CommandTimeout
    Specifies the command timeout in seconds; the default is 120.

ModulesPath
    Specifies the modules (authentication, information accessing, and resources) path; the default is /usr/local/lib/alat.

LogSession
    Specifies whether auditd(8) should log each audit(1) session commmands; the default is ``no''.

LogDebugInfo
    Specifies whether auditd(8) should log debugging information; the default is ``no''.

QuietMode
    Does not print any messages (disables LogDebugInfo and LogSession options); the default is ``no''.

SyslogFacility
    Specifies syslog facility to log auditd(8) messages via syslog(3); allowed values are: AUTH, AUTHPRIV, DAEMON, USER; the default is DAEMON. The syslog level depends on the message type: LOG_ERROR for fatal and error messages, LOG_DEBUG for debugging, LOG_WARNING for warnings, and LOG_INFO for session messages.

AuthModule
    Allow auditors to use the specified authentication module (more than one method can be used by adding multiple AuthModule lines); see audit(1) manual page for more information about AUTHENTICATION MODULES.

IaModule
    Allow auditors to use the specified Information Accessing module (more than one module can be used by adding in multiple IaModule lines); see manual page for more information about INFORMATION ACCESSING MODULES.

ResModule
    Specify de resources module used to hold auditd(8) internal data (auditor permissions, download status, etc.); the default is ``local''. See RESOURCES MODULES section below and audit(1) man page for more information about RESOURCES.

RESOURCES MODULES
Auditd stores internal and auditors data on a resource database; the resource module saves all data on a storage that is independent from auditd, that means, the place where the resources are located depends only on the resources module used.

  LOCAL RESOURCES MODULE
This module stores resources on text files located under the /var/audit/resources directory, each file contains the resources for a given auditor. If auditor manager is logged into the audited host, he is allowed to create, remove, and change auditors and their resources by hand using a text editor instead of being using the -r audit(1) option.

  LOCAL RESOURCES MODULE FILE FORMAT
Since resources may contain binary data, all characters whose code belongs to the 0x00-0x1F or 0x7F-0xFF ranges (non-printable characters) must be coded as ``\nn'', where ``nn'' is the character code expressed as two digit hexadecimal number (ie. the 0x07 character must be specified as ``\07'' instead of ``\7''); codes between 0x20 and 0x7E can be specified both, as printable ascii(7) characters or like the formers.

The beginning of a resource is indicated by an ``['' (opening bracket), then follows the resource name (can't contain zero codes) and finally, a ``]'' (closing bracket). The general schema is as follows:

    [ resource_name_a ]
    	resource_a contents
    [ resource_name_b ]
    	resrouce b contents
    .
    .

New lines and blank spaces don't affect the resource contents, except they are specified as ``\nn'':

    [ my resource ]
    	Hi. How are you?
    [ pepe ]
    [ another_resource ]

The above text declares three resources whose names are: ``my resource'', ``pepe'', and ``another_resource''. If we want the text ``[ pepe ]'' belongs to the ``my resource'' contents, the bracket ``['' character must be escaped with ``\['':

    [ my resource ]
    	Hi. How are you?
    \[ pepe ]
    [ another_resource]

or formatted like this:

    [ my resource ]
    	Hi. How are you?
    	\[ pepe ]
    [ another_resource]

With the above, the contents of ``my resource'' will be ``Hi. How are you?[ pepe ]''. As mentioned earlier if we want a new line character between ``..you?'' and ``[ pepe ]'' it must be escaped:

    [ my resource ]
    	Hi. How are you?\n
    	\[ pepe ]

Or:

    [ my resource ]
    	Hi. How are you?
    	\n\[ pepe ]

Or:

    [ my resource ]
    	Hi. How are you?\n\[ pepe ]

With the above examples the contents will be:

    	"Hi. How are you?
    	[ pepe ]"

The escabale characters are:

•   Newline: ``\n'' or ``\0A''

•   Blank space: ``\20''

•   Tabulator: ``\t'' or ``\09''

•   Opening bracket: ``\[''

•   Inverted slash: ``\\''

Blank spaces between the ``['' and ``]'' delimiters on the resource name declaration don't have effect on the resource name itself, except escaping:

    	[ Offset ! ! ]
    	[Offset! !]

Here the name is ``Offset ! !'' in both cases; if we want the resource name as ``Offset ! ! '', with an ending white space, it must be escaped as follows:

    	[ Offset ! !\20 ]

LOCAL RESOURCES MODULE file supports INCLUDE FILES: one file is allowed to include other files, the specification is as follows:

    	[ include filename ]

The ``filename'' specified above should be a valid resources file and it may contain other include statments. The reference to the include doen't get lost after loading the resources on the included file, so, if two users share a file (with common permissions) and one user modify the contents of a resource previously loaded from that file then, the value of that resource will be changed for the other user the next time he logs in. If both users change a resource that belongs to the common file, both will be using their own values until the session in finished; after that the value saved on the file will be the value of the last session.

EXAMPLES
Example of a configuration file:

    # my auditd configuration file
    ListenAddress	192.168.68.100
    Port           32768
    ModulesPath    /lib/auditd
    AuthModule     raw
    AuthModule     srp
    IaModule       syslog
    IaModule       my_own_ia_module
    ResModule      my_own_resources_module

If a given manager wants an auditor on a host and the auditd server uses the LOCAL RESOURCES MODULE and he has access to that host, he can create the auditor and his permissions by creating a file under /var/audit/resources; the name of this file is the auditor's login name:

    [ IAPerms ]
    	IGZ
    [ IAPerms_/var/log/messages ]
    	GR
    [ IAPerms_/var/log/authlog ]
    	L
    [ ResPerm_SRPPass ]
    	F
    [ ResAdmin ]
    	juan\ncarlos\n

With the avobe the new auditor has the following capabilities:

•   He has permissions to ``list'' (know the existence of) the /var/log/authlog logfile.

•   He has permissions to ``list'', ``get'' (download information and logs), and ``rotate'' the /var/log/messages logfile.

•   He has permissions to ``list'', ``info'' (download information), ``get'', and ``zap'' (truncate) all other logfiles.

•   He can examine the content of ``SRPPass'' resource but can't change its value (can't change his own SRP password).

•   He is the chief of both ``juan'' and ``carlos'' (can change their resources).

SEE ALSO
audit(1), kill(1), syslog(3).

BUGS

•   To avoid race conditions accessing logfiles, auditd accepts only one connection at a time; this will be fixed in a future release.

•   If you found bugs, please report them to audit-bugs@core-sdi.com