Comments on: Stump the Chump with Auditd 01 http://security.blogoverflow.com/2013/09/stump-the-chump-with-auditd-01/ The Security Stack Exchange Blog Sat, 06 Feb 2016 05:11:22 +0000 hourly 1 https://wordpress.org/?v=4.5.6 By: ewwhite http://security.blogoverflow.com/2013/09/stump-the-chump-with-auditd-01/#comment-179416 Thu, 03 Oct 2013 05:33:48 +0000 http://security.blogoverflow.com/?p=1064#comment-179416 Thank you. This has been an interesting solution. I appreciate your efforts on this. A few notes:

  • I was surprised that reporting requires a few steps, namely the process of correlating the event ID with the more verbose logs.

  • Running auditd reports from cron requires a “–input-logs” flag added to the string (on RHEL system at least). Otherwise, aureport expects stdin as input and provides no output.

  • This reporting exposed some automated actions that actually modify compiled files. “/opt/application/temp.bin” is changed frequently. Is there any means to exclude specific files in a watched directory from the auditing action?

]]>