tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add some auditd rules for log server.

This commit is contained in:
Samson-W 2021-07-17 22:47:39 +08:00
parent e4743a7588
commit 9b7beb1588
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
bin/hardening/8.1.27_record_Events_that_modify_conf_files.sh
View File

@ -84,7 +84,11 @@ check_config() {
-a always,exit -F dir=/etc/sysconfig/ip6tables -F perm=wa -k config_file_change
-a always,exit -F dir=/etc/sysconfig/ip6tables-config -F perm=wa -k config_file_change
-a always,exit -F dir=/etc/sysconfig/iptables-config -F perm=wa -k config_file_change
-a always,exit -F path=/etc/sysctl.conf -F perm=wa -k config_file_change'
-a always,exit -F path=/etc/sysctl.conf -F perm=wa -k config_file_change
-a always,exit -F path=/etc/rsyslog.conf -F perm=wa -k config_file_change
-a always,exit -F path=/etc/audisp/plugins.d/au-remote.conf -F perm=wa -k config_file_change
-a always,exit -F path=/etc/logrotate.conf -F perm=wa -k config_file_change
-a always,exit -F dir=/etc/logrotate.d/ -F perm=wa -k config_file_change'
# Debian
else
AUDIT_PARAMS='-a always,exit -F path=/etc/audisp/audisp-remote.conf -F perm=wa -k config_file_change
@ -99,7 +103,11 @@ check_config() {
-a always,exit -F dir=/etc/profile.d/ -F perm=wa -k config_file_change
-a always,exit -F dir=/etc/security/ -F perm=wa -k config_file_change
-a always,exit -F dir=/etc/iptables/ -F perm=wa -k config_file_change
-a always,exit -F path=/etc/sysctl.conf -F perm=wa -k config_file_change'
-a always,exit -F path=/etc/sysctl.conf -F perm=wa -k config_file_change
-a always,exit -F path=/etc/rsyslog.conf -F perm=wa -k config_file_change
-a always,exit -F path=/etc/audisp/plugins.d/au-remote.conf -F perm=wa -k config_file_change
-a always,exit -F path=/etc/logrotate.conf -F perm=wa -k config_file_change
-a always,exit -F dir=/etc/logrotate.d/ -F perm=wa -k config_file_change'
fi
}