solaris BSM and Auditing

Hi Guys,

I am new to this forum so I am sorry if i posted this thread in the wrong place. I am currently trying to get BSM to work on solaris 10 by Logging few things for me. I need your help to complete this task please.

this is the config of the audit files:

audit_conto

# Copyright (c) 1988 by Sun Microsystems, Inc.
#
# ident "@(#)audit_control.txt 1.4 00/07/17 SMI"
#
dir:/var/audit
flags:lo,ad,cc
minfree:20
naflags:lo,ad,ex

audit class

#
# mask:name:description
#
0x00000000:no:invalid class
0x00000001:fr:file read
0x00000002:fw:file write
0x00000004:fa:file attribute access
0x00000008:fm:file attribute modify
0x00000010:fc:file create
0x00000020:fd:file delete
0x00000040:cl:file close
0x00000100:nt:network
0x00000200:ip:ipc
0x00000400:na:non-attribute
0x00001000:lo:login or logout
0x00004000:ap:application
0x00010000:ss:change system state
0x00020000:as:system-wide administration
0x00040000:ua:user administration
0x00070000:am:administrative (meta-class)
0x00080000:aa:audit utilization
0x000f0000:ad:old administrative (meta-class)
0x00100000:ps:process start/stop
0x00200000:pm:process modify
0x00300000:pc:process (meta-class)
0x20000000:io:ioctl
0x40000000:ex:exec
0x80000000:ot:other
0xffffffff:all:all classes (meta-class)
0x08000000:cc:CIS custom class

I only need to audit what users execute. Is there an easy way to do it.

Thanks

You want to add the ex class to the flags: in audit_control so it reads:
flags:lo,ad,cc,ex

Or as you have defined your own audit class (cc) you could add it to AUE_EXECVE in audit_event so it reads:
22:AUE_EXECVE:execve(2):ps,ex,cc

See this post for more information.

Thanks I will try that today. The only thing now is formatting the output via praudit/auditrace. I will have to work on creating a script that will do that for me.

Hi,

I have managed to get rootsh to work. What I want it to do is to start logging users session as soon as they loging to the box. rootsh uses sudo root user and I don't have that setup here. what do you guys think?

I thought about using the .profile and adding a line like

/usr/local/bin/rootsh --user=$username --logdir=$logs

any idea?

thanks

IMO you get better logging with Solaris auditing than rootsh. If I know you audit my actions with rootsh I will just write a C program that does all my covert actions and you won't be able to see it - the only thing rootsh catches is that I downloaded a file which I then executed.

With Solaris auditing you can not hide your actions as the logging happens in the kernel (for system calls), so even if you run an unknown program I will be able to see what it was up to.

The only downside to Solaris auditing is that the output format is harder to read, but there will soon be a nice gui to view the audit trail in, where you easily can chose to view the commands executed by a user.

right, here is what i did then.

# Copyright (c) 1988 by Sun Microsystems, Inc.
#
# ident "@(#)audit_control.txt 1.4 00/07/17 SMI"
#
dir:/var/audit
flags:lo,ad,cc,ex
minfree:20
naflags:lo

# User Level Class Masks
#
# Developers: If you change this file you must also edit audit.h.
#
# "Meta-classes" can be created; these are supersets composed of multiple base
# classes, and thus will have more than 1 bit in its mask. See "ad", "all",
# "am", and "pc" below for examples.
#
# The "no" (invalid) class below is commonly (but not exclusively) used in
# audit_event for obsolete events.
#
#
# File Format:
#
# mask:name:description
#
0x00000000:no:invalid class
0x00000001:fr:file read
0x00000002:fw:file write
0x00000004:fa:file attribute access
0x00000008:fm:file attribute modify
0x00000010:fc:file create
0x00000020:fd:file delete
0x00000040:cl:file close
0x00000100:nt:network
0x00000200:ip:ipc
0x00000400:na:non-attribute
0x00001000:lo:login or logout
0x00004000:ap:application
0x00010000:ss:change system state
0x00020000:as:system-wide administration
0x00040000:ua:user administration
0x00070000:am:administrative (meta-class)
0x00080000:aa:audit utilization
0x000f0000:ad:old administrative (meta-class)
0x00100000:ps:process start/stop
0x00200000:pm:process modify
0x00300000:pc:process (meta-class)
0x20000000:io:ioctl
0x40000000:ex:exec
0x80000000:ot:other
0xffffffff:all:all classes (meta-class)
0x08000000:cc:CIS custom class

23:AUE_EXECVE:execve(2):ps,ex,cc

Just like how you recommanded. ( I think) !!

Now, I cann't see things like (cd / or ls -ltr) command or i may need to look deep into the log files. In addation, the size of the logs is in Gigs, it looks like i am going to need to acquire more disk space soon!!

snap shot!!

subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,168,2,memcntl(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.298 +00:00
argument,1,0xff360000,base
argument,2,0x73d4,len
argument,3,0x4,cmd
argument,4,0x3,arg
argument,5,0x0,attr
argument,6,0x0,mask
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,114,2,munmap(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.298 +00:00
argument,1,0xff344000,addr
argument,2,0x10000,len
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,168,2,memcntl(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.298 +00:00
argument,1,0xff340000,base
argument,2,0x12b8,len
argument,3,0x4,cmd
argument,4,0x3,arg
argument,5,0x0,attr
argument,6,0x0,mask
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,114,2,munmap(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.299 +00:00
argument,1,0xff2d4000,addr
argument,2,0x10000,len
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,168,2,memcntl(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.299 +00:00
argument,1,0xff200000,base
argument,2,0x204d8,len
argument,3,0x4,cmd
argument,4,0x3,arg
argument,5,0x0,attr
argument,6,0x0,mask
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,114,2,munmap(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.300 +00:00
argument,1,0xff31c000,addr
argument,2,0x10000,len
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,168,2,memcntl(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.300 +00:00
argument,1,0xff310000,base
argument,2,0x3588,len
argument,3,0x4,cmd
argument,4,0x3,arg
argument,5,0x0,attr
argument,6,0x0,mask
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,114,2,munmap(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.301 +00:00
argument,1,0xff192000,addr
argument,2,0x10000,len
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,168,2,memcntl(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.301 +00:00
argument,1,0xff100000,base
argument,2,0x15b74,len
argument,3,0x4,cmd
argument,4,0x3,arg
argument,5,0x0,attr
argument,6,0x0,mask
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
header,114,2,munmap(2),,beatrix.cyberslotz.co.uk,2007-03-06 13:56:42.301 +00:00
argument,1,0xff1e2000,addr
argument,2,0x10000,len
subject,hassan,root,root,root,root,10312,554721698,14555 65559 172.16.1.202
return,success,0
file,2007-03-06 13:56:42.310 +00:00,

the idea behind this auditing thing is, to have all commands logged now, i didn't think the output is going to be like that. Now, if i get a request from management to produce the command set for one the users is going to be a nightmare to have something that will explaine to them what that users did in a nice layout.

any idea when the gui will be downloadable.
thanks

Since you added cc which contains AUE_EXECVE you don't need ex.

What other events have you tagged with cc?

It is strange that you see events from the ot and cl classes, as you don't have those in audit_control. What does audit_user look like?

Could you run auditconfig -getpinfo pid where pid is the shell where you want to see the exec(s)'s?

To pick out the exec(2)'s you should run:
auditreduce -m AUE_EXECVE /path/to/audit-trail | praudit

If you want to work with just one user, you can use the -u aid option to auditreduce in conjunction with the example above. That way you'll just get the exec(2)'s belonging to that user.

The beta will be out in about one to two months. It is more or less ready now, we there is a lot of polishing to do...

Hi,

i have change the audit_control please see below

Audit_control

dir:/var/audit
flags:lo,ad,cc
minfree:20
naflags:lo

audit_event

0

Audit_user

#
# Copyright (c) 1988 by Sun Microsystems, Inc.
#
# ident "@(#)audit_user.txt 1.6 00/07/17 SMI"
#
#
# User Level Audit User File
#
# File Format
#
# username:always:never
#
root:lo:no
hassan:lo,ad,cc
paul:lo,cc,ad

#ps
PID TTY TIME CMD
10696 pts/1 0:00 login
10790 pts/1 0:00 ps
10705 pts/1 0:00 ksh

#auditconfig -getpinfo 10705
audit id = hassan(100)
process preselection mask = all(0xffffffff,0xffffffff)
terminal id (maj,min,host) = 6413,23,unknown(172.16.1.202)
audit session id = 3136872915

auditreduce -u $uid /path/to/audit-trail | praudit
file,1970-01-01 01:00:00.000 +01:00,
file,2007-03-07 10:34:13.000 +00:00,

auditreduce -m AUE_EXECVE /path/to/audit-trail | praudit
file,1970-01-01 01:00:00.000 +01:00,
file,2007-03-07 10:33:21.000 +00:00,

Would it be possible to audit events from user level audit events
# 2048 - 6143 Reserved
?

I tried /usr/sbin/auditconfig -setclass 2048 6143 but it don't work
auditconfig: Invalid kernel audit event number specified.
2048 is outside allowable range 0-512.

(i might of made a mistake in the command line)

As you can see, I have done all the recommand command. What i had in mind is a simple output from the logs just like what you get from rootsh. I will have a look at auditreduce and see if i can tune the output.

Thanks

This tells you that all events generated by this process will end up in the audit trail.

You need to replace /path/to/audit-trail with the actual path of the audit trail, e.g. /var/audit/20070307102412.not_terminated.vaccine.

I'm not sure what you are trying to do here. The system audits those events based on your preselection mask, there is nothing you need to do to "enable" them.

auditd you are the king of auditing. it's working now.

it's logging (cd,ls) commands.

header,137,2,execve(2),,beatrix.cyberslotz.co.uk,2007-03-07 14:15:59.040 +00:00
path,/usr/bin/ls
attribute,100555,root,bin,32,342,0
exec_args,1,ls

task completed.

thank you

I am having a problem getting info from the x2100 servers running solaris 10. I can get things like (ls,cd) and so on but if i use the vi command the logs doesn't tell me what file the user has opened or (vi) at the time.

I wonder if it's a problem with the x2100 os artch or maybe some extra config that i have to do to fix it. I am using the excat same config on my test Sun e250 and that is working just fine.

Help please.

Thanks

You need to use the +argv audit policy to see the arguments to exec(2).

Run:
auditconfig -setpolicy +argv

and then add the following line to /etc/security/audit_startup (for it to persist across reboots):
/usr/sbin/auditconfig -setpolicy +argv

thanks auditd its working...

Hi auditd,
I wanted to see only login/logout and exec event in my logs and set up my auditd configuration as follows. Since i get the logs from binary file to my Arcsight Agent using Arcsight Solaris BSM Agent, i get the logs that i don't want to see. So these logs also increasing the file size.

Since i am not familier with Solaris&BSM i almost try every option to filter following events. I don't know what they means so i don't get such logs.

How can i make a config that i can only see who is logged in and what command is he/she typed?

Thanks in advance!

AUE_DOORFS_DOOR_CALL ==
AUE_IOCTL

###audit_startup ###
#!/bin/sh
/usr/bin/echo "Starting BSM services."
/usr/sbin/deallocate -Is
/usr/sbin/auditconfig -conf
/usr/sbin/auditconfig -aconf
/usr/sbin/auditconfig -setpolicy +cnt
/usr/sbin/auditconfig -setpolicy +argv

### audit_control ###
dir:/array/auditlogs
minfree:20
flags:lo,+ex
naflags:lo,+ex

####audit_user ####
#
# Copyright (c) 1988 by Sun Microsystems, Inc.
#
# ident "@(#)audit_user.txt 1.6 00/07/17 SMI"
#
#
# User Level Audit User File
#
# File Format
#
# username:always:never
#
#root:all:no

you auditd config should like the following:

run

/etc/security/bsmconv

make sure the /etc/system has been update
(set c2audit:audit_load = 1)

reboot

vi audit_startup

/usr/bin/echo "Starting BSM services."
/usr/sbin/auditconfig -conf
/usr/sbin/auditconfig -aconf
/usr/sbin/auditconfig -setpolicy +argv

Add the following class to you /etc/security/audit_class

0x08000000:cc:CIS custom class

vi the audit_event

find entry 23 and add cc, just like the following entry:

23:AUE_EXECVE:execve(2):ps,ex,cc

vi audit_control

make sure that you have the following lines:

dir:/var/audit
flags:lo,ad,cc
minfree:20
naflags:lo

vi audit_user

where userX is the name of the user you want to audit.

userX:lo:no
userX:lo,ad,cc,exec,all
userX:lo,ad,cc,exec,al

to get any reading from your logs use the below command:

auditreduce -c lo /var/audit/20070329110000.not_terminated.*servername* |praudit

and that will give you what you want !!
good luck.

hi auditd. Its ok now
Thanks for yor help.

Hello all,

I am working with a solaris 10 system that has minimum 250 users on it during any business day. I need to track all +ex where the effective uid is root and nothing more. BSM seems like the best tool for this because of how well it tracks each user with it's audit-id.

I have root:+ex in my audit_user file, however this setting applies only for console logins of root because we do not allow remote. I have flags: +ex in my audit_control file, however this setting with the number of users I have will generate an audit trail which is too large for my file system with a ton of unnecessary data. Does anyone know how I could setup BSM to audit only the effective UID of root?

I need to find some answers for this, according to the manuals this BSM auditing when turned on uses up a lot of disk space, my question is how much disk will the logs use up every month?

Also does anybody also know what is the equivalent of solaris BSM on hpux, does HPUX have any built in auditing capabilities similiar to solaris?

How long is a piece of string?

The problem is that it depends on a lot of things, like:

• number of active and audited users
• user activity (running lots of commands)
• policy settings (such as argv and arge)

The best way is to start auditing using the settings you want and closely monitor the audit trail, and then tune the settings if they grow too large.

I have system which generates over 100 MB/day and I have others which generates less than 1 MB/day - using the same audit settings.

See this page for more information.