日志审计策略配置audit

开启audit审计功能，可以监控指定用户或目录，缺省会监控root的所有登录和操作。

将如下规则添加到”/etc/audit/audit.rules”中，实现监控所有用户的登录行为，包含用户所有操作，以及shell脚本中的命令

  1. -a exit,always -F arch=b64 -S execve -kexec
  2. -a exit,always -F arch=b32 -S execve -kexec

添加后使用ausearch -k exec来列出用户操作的记录。

将如下规则添加到”/etc/audit/audit.rules”中，实现对重点配置文件的监控

centos6 或 redhat 6
  1. -w /etc/crontab -p wa -k crontab
  2. -w /etc/hosts -p wa -k hosts
  3. -w /etc/hosts.allow -p wa -k hosts-allow
  4. -w /etc/hosts.deny -p wa -k hosts-deny
  5. -w /etc/fstab -p wa -k fstab
  6. -w /etc/passwd -p wa -k passwd
  7. -w /etc/shadow -p wa -k shadow
  8. -w /etc/group -p wa -k group
  9. -w /etc/gshadow -p wa -k gshadow
  10. -w /etc/ntp.conf -p wa -k ntp
  11. -w /etc/sysctl.conf -p wa -k sysctl
  12. -w /etc/security/limits.conf -p wa -klimits
  13. -w /boot/grub/grub.conf -p wa -k grub
  14. -w /etc/ssh/sshd_config -p wa -k ssh 
  15. -w /etc/udev/rules.d/ -p wa -k udev
  16. -w /etc/profile -p wa -k profile
  17. -w /etc/kdump.conf -p wa -k kdump
  18. -w /etc/lvm/lvm.conf -p wa -k lvm
  19. -w /etc/login.defs -p wa -k login-defs
  20. -w /etc/rsyslog.conf -p wa -k rsyslog
  21. -w /etc/sysconfig/i18n -p wa -k i18n
  22. -w /etc/sysconfig/network -p wa -k network
  23. -w /etc/multipath.conf -p wa -k multipath
  24. -a exit,always -F arch=b64 -S execve -kexec
  25. -a exit,always -F arch=b32 -S execve -kexec

centos 7 或 redhat 7

  1. -w /etc/crontab -p wa -k crontab
  2. -w /etc/hosts -p wa -k hosts
  3. -w /etc/hosts.allow -p wa -k hosts-allow
  4. -w /etc/hosts.deny -p wa -k hosts-deny
  5. -w /etc/fstab -p wa -k fstab
  6. -w /etc/passwd -p wa -k passwd
  7. -w /etc/shadow -p wa -k shadow
  8. -w /etc/group -p wa -k group
  9. -w /etc/gshadow -p wa -k gshadow
  10. -w /etc/chrony.conf-p wa -k ntp
  11. -w /etc/sysctl.conf -p wa -k sysctl
  12. -w /etc/security/limits.conf -p wa -klimits
  13. -w /boot/grub2/grub.cfg -p wa -k grub
  14. -w /etc/ssh/sshd_config -p wa -k ssh 
  15. -w /etc/udev/rules.d/ -p wa -k udev
  16. -w /etc/profile -p wa -k profile
  17. -w /etc/kdump.conf -p wa -k kdump
  18. -w /etc/lvm/lvm.conf -p wa -k lvm
  19. -w /etc/login.defs -p wa -k login-defs
  20. -w /etc/rsyslog.conf -p wa -k rsyslog
  21. -w /etc/locale.conf-p wa -k i18n
  22. -w /etc/sysconfig/network -p wa -k network
  23. -w /etc/multipath.conf -p wa -k multipath
  24. -a exit,always -F arch=b64 -S execve -kexec
  25. -a exit,always -F arch=b32 -S execve -kexec

使用ansible批量对主机进行操作

使用ansible工具的script模块在远程主机执行本地脚本

  1. 脚本如下
  1. #! /bin/bash
  3. system_version=`uname -r | awk -F '.' '{print $1}'`
  5. #添加文件审计规则
  6. if [ "$system_version" == "2" ]
  7. then
  8.     echo "-w /etc/crontab -p wa -k crontab
  9. -w /etc/hosts -p wa -k hosts
  10. -w /etc/hosts.allow -p wa -k hosts-allow
  11. -w /etc/hosts.deny -p wa -k hosts-deny
  12. -w /etc/fstab -p wa -k fstab
  13. -w /etc/passwd -p wa -k passwd
  14. -w /etc/shadow -p wa -k shadow
  15. -w /etc/group -p wa -k group
  16. -w /etc/gshadow -p wa -k gshadow
  17. -w /etc/ntp.conf -p wa -k ntp
  18. -w /etc/sysctl.conf -p wa -k sysctl
  19. -w /etc/security/limits.conf -p wa -klimits
  20. -w /boot/grub/grub.conf -p wa -k grub
  21. -w /etc/ssh/sshd_config -p wa -k ssh 
  22. -w /etc/udev/rules.d/ -p wa -k udev
  23. -w /etc/profile -p wa -k profile
  24. -w /etc/kdump.conf -p wa -k kdump
  25. -w /etc/lvm/lvm.conf -p wa -k lvm
  26. -w /etc/login.defs -p wa -k login-defs
  27. -w /etc/rsyslog.conf -p wa -k rsyslog
  28. -w /etc/sysconfig/i18n -p wa -k i18n
  29. -w /etc/sysconfig/network -p wa -k network
  30. -w /etc/multipath.conf -p wa -k multipath
  31. -a exit,always -F arch=b64 -S execve -kexec
  32. -a exit,always -F arch=b32 -S execve -kexec" >>/etc/audit/audit.rules
  33. elif [ "$system_version" == "3" ]
  34. then
  35.     echo "-w /etc/crontab -p wa -k crontab
  36. -w /etc/hosts -p wa -k hosts
  37. -w /etc/hosts.allow -p wa -k hosts-allow
  38. -w /etc/hosts.deny -p wa -k hosts-deny
  39. -w /etc/fstab -p wa -k fstab
  40. -w /etc/passwd -p wa -k passwd
  41. -w /etc/shadow -p wa -k shadow
  42. -w /etc/group -p wa -k group
  43. -w /etc/gshadow -p wa -k gshadow
  44. -w /etc/chrony.conf-p wa -k ntp
  45. -w /etc/sysctl.conf -p wa -k sysctl
  46. -w /etc/security/limits.conf -p wa -klimits
  47. -w /boot/grub2/grub.cfg -p wa -k grub
  48. -w /etc/ssh/sshd_config -p wa -k ssh 
  49. -w /etc/udev/rules.d/ -p wa -k udev
  50. -w /etc/profile -p wa -k profile
  51. -w /etc/kdump.conf -p wa -k kdump
  52. -w /etc/lvm/lvm.conf -p wa -k lvm
  53. -w /etc/login.defs -p wa -k login-defs
  54. -w /etc/rsyslog.conf -p wa -k rsyslog
  55. -w /etc/locale.conf-p wa -k i18n
  56. -w /etc/sysconfig/network -p wa -k network
  57. -w /etc/multipath.conf -p wa -k multipath
  58. -a exit,always -F arch=b64 -S execve -kexec
  59. -a exit,always -F arch=b32 -S execve -kexec" >>/etc/audit/audit.rules
  60. else
  61.     echo "It is not a valid system version!"
  62. fi
  64. #重启auditd服务，注意：该服务不能使用systemctl重启
  65. if [ "$?" == "0" ]
  66. then
  67.     service auditd restart
  68. else
  69.     echo "Add configs failed!"
  70. fi
  1. ansible命令
  1. cd <脚本目录>
  2. ansible 'host_inventory' -u root -m script -a '<脚本名或脚本全路径>'
文档更新时间: 2019-03-28 15:57   作者：张尚