96 lines
6.1 KiB
Plaintext
96 lines
6.1 KiB
Plaintext
## First rule - delete all
|
|
-D
|
|
|
|
## Increase the buffers to survive stress events.
|
|
## Make this bigger for busy systems
|
|
-b 8192
|
|
|
|
## This determine how long to wait in burst of events
|
|
--backlog_wait_time 0
|
|
|
|
## Set failure mode to syslog
|
|
-f 1
|
|
|
|
|
|
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
|
|
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
|
|
-a always,exit -F arch=b64 -S clock_settime -k time-change
|
|
-a always,exit -F arch=b32 -S clock_settime -k time-change
|
|
-w /etc/localtime -p wa -k time-change
|
|
-w /etc/group -p wa -k identity
|
|
-w /etc/passwd -p wa -k identity
|
|
-w /etc/gshadow -p wa -k identity
|
|
-w /etc/shadow -p wa -k identity
|
|
-w /etc/security/opasswd -p wa -k identity
|
|
-a exit,always -F arch=b64 -S sethostname -S setdomainname -k system-locale
|
|
-a exit,always -F arch=b32 -S sethostname -S setdomainname -k system-locale
|
|
-w /etc/issue -p wa -k system-locale
|
|
-w /etc/issue.net -p wa -k system-locale
|
|
-w /etc/hosts -p wa -k system-locale
|
|
-w /etc/network -p wa -k system-locale
|
|
-w /etc/selinux/ -p wa -k MAC-policy
|
|
-w /var/log/faillog -p wa -k logins
|
|
-w /var/log/lastlog -p wa -k logins
|
|
-w /var/log/tallylog -p wa -k logins
|
|
-w /var/run/utmp -p wa -k session
|
|
-w /var/log/wtmp -p wa -k session
|
|
-w /var/log/btmp -p wa -k session
|
|
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
|
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
|
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
|
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
|
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
|
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
|
|
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
|
|
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
|
|
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
|
|
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
|
|
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
|
|
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
|
|
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete
|
|
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete
|
|
-w /etc/sudoers -p wa -k sudoers
|
|
-w /etc/sudoers.d/ -p wa -k sudoers
|
|
-e 2
|
|
-w /var/log/auth.log -p wa -k sudoaction
|
|
-w /sbin/insmod -p x -k modules
|
|
-w /sbin/rmmod -p x -k modules
|
|
-w /sbin/modprobe -p x -k modules
|
|
-a always,exit -F arch=b32 -S init_module -S delete_module -S create_module -S finit_module -k modules
|
|
-a always,exit -F arch=b64 -S init_module -S delete_module -S create_module -S finit_module -k modules
|
|
-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-ssh
|
|
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
|
|
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
|
|
-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd
|
|
-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd
|
|
-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd
|
|
-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd
|
|
-a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change
|
|
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change
|
|
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change
|
|
-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change
|
|
-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change
|
|
-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-postfix
|
|
-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-postfix
|
|
-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-cron
|
|
-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-pam
|
|
-a always,exit -F path=/sbin/pam_tally -F perm=wxa -F auid>=1000 -F auid!=4294967295 -k privileged-pam
|
|
-a always,exit -F path=/sbin/pam_tally2 -F perm=wxa -F auid>=1000 -F auid!=4294967295 -k privileged-pam
|
|
-a always,exit -F path=/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
|
|
-a always,exit -F path=/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
|
|
-a always,exit -F path=/bin/ping -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
|
|
-w /etc/audisp/audisp-remote.conf -p wa -k config_file_change
|
|
-w /etc/audit/auditd.conf -p wa -k config_file_change
|
|
-w /etc/audit/rules.d/ -p wa -k config_file_change
|
|
-w /etc/default/grub -p wa -k config_file_change
|
|
-w /etc/fstab -p wa -k config_file_change
|
|
-w /etc/hosts.deny -p wa -k config_file_change
|
|
-w /etc/login.defs -p wa -k config_file_change
|
|
-w /etc/pam.d/ -p wa -k config_file_change
|
|
-w /etc/profile -p wa -k config_file_change
|
|
-w /etc/profile.d/ -p wa -k config_file_change
|
|
-w /etc/security/ -p wa -k config_file_change
|
|
-w /etc/iptables/ -p wa -k config_file_change
|
|
-w /etc/sysctl.conf -p wa -k config_file_change
|
|
|