Skip to main content

Chapter 9.4 - Security Audit and Monitoring

Learning Objectives​

By the end of this chapter, you will be able to:

  • Use Linux audit tools
  • Monitor access attempts
  • Analyze security logs
  • Detect suspicious activities
  • Configure security alerts
  • Understand system audit tools

Linux Audit (auditd)​

Installation​

# Ubuntu/Debian
sudo apt install auditd audispd-plugins

# Red Hat/CentOS
sudo yum install audit

Service​

# Status
sudo systemctl status auditd

# Start
sudo systemctl start auditd

# Enable
sudo systemctl enable auditd

Audit Rules​

View Rules​

# List rules
sudo auditctl -l

# View loaded rules
sudo ausearch -i

Add Rules​

# Audit file access
sudo auditctl -w /etc/passwd -p rwxa -k passwd_access

# Audit sudo commands
sudo auditctl -w /usr/bin/sudo -p x -k sudo_commands

# Audit network connections
sudo auditctl -a always,exit -F arch=b64 -S connect -k network_connect

# Audit permission changes
sudo auditctl -w /etc -p wa -k etc_changes

Permanent Rules​

# File: /etc/audit/rules.d/audit.rules
# Format:
-w /etc/passwd -p rwxa -k passwd_access
-w /etc/shadow -p rwxa -k shadow_access
-w /usr/bin/sudo -p x -k sudo_commands

Reload:

sudo systemctl restart auditd

ausearch​

# Search by key
sudo ausearch -k passwd_access

# Search by user
sudo ausearch -ua user1

# Search by type
sudo ausearch -m USER_LOGIN

# Search recent
sudo ausearch -ts recent

# Search period
sudo ausearch -ts 01/01/2024 00:00:00 -te 01/02/2024 00:00:00

aureport​

# Summary report
sudo aureport

# Report by user
sudo aureport -u

# Report by event type
sudo aureport -e

# Failed report
sudo aureport --failed

# Connection report
sudo aureport -au

Log Monitoring​

Security Logs​

# Ubuntu/Debian
sudo tail -f /var/log/auth.log

# Red Hat/CentOS
sudo tail -f /var/log/secure

# Failed attempts
sudo grep "Failed password" /var/log/auth.log

# SSH connections
sudo grep "sshd" /var/log/auth.log

# sudo
sudo grep "sudo" /var/log/auth.log

last and lastlog​

# Connection history
last
last -n 20  # Last 20

# Last login by user
lastlog

# Specific user
lastlog -u user1

who and w​

# Connected users
who
w

# Details
w -f

Intrusion Detection​

Monitoring Script​

#!/bin/bash
# Security monitoring

LOG_FILE="/var/log/security-monitor.log"

log_event() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >> "$LOG_FILE"
}

# Failed SSH attempts
FAILED_SSH=$(grep "Failed password" /var/log/auth.log | wc -l)
if [ "$FAILED_SSH" -gt 10 ]; then
    log_event "ALERT: $FAILED_SSH failed SSH attempts"
fi

# New users
NEW_USERS=$(lastlog | grep -v "Never logged in" | wc -l)
log_event "Active users: $NEW_USERS"

# Recently modified files
MODIFIED=$(find /etc -type f -mtime -1 2>/dev/null | wc -l)
if [ "$MODIFIED" -gt 0 ]; then
    log_event "WARNING: $MODIFIED files modified in /etc"
fi

Automatic Alerts​

#!/bin/bash
# Security alerts by email

# Configuration
ALERT_EMAIL="admin@example.com"
THRESHOLD=10

# Failed SSH attempts
FAILED=$(grep "Failed password" /var/log/auth.log | tail -20 | wc -l)

if [ "$FAILED" -ge "$THRESHOLD" ]; then
    echo "ALERT: $FAILED failed SSH attempts" | \
        mail -s "SSH Security Alert" "$ALERT_EMAIL"
fi

Monitoring Tools​

fail2ban​

Protection against brute force:

# Install
sudo apt install fail2ban

# Configuration
sudo nano /etc/fail2ban/jail.local

# Enable
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Status
sudo fail2ban-client status
sudo fail2ban-client status sshd

rkhunter​

Rootkit detection:

# Install
sudo apt install rkhunter

# Update database
sudo rkhunter --update

# Scan
sudo rkhunter --check

# Quick scan
sudo rkhunter --check --skip-keypress

chkrootkit​

Rootkit detection:

# Install
sudo apt install chkrootkit

# Scan
sudo chkrootkit

Security Reports​

Report Script​

#!/bin/bash
# Daily security report

REPORT="/var/log/security-report-$(date +%Y%m%d).txt"

{
    echo "=== SECURITY REPORT $(date) ==="
    echo
    echo "=== Connections ==="
    last -n 20
    echo
    echo "=== Failed attempts ==="
    grep "Failed password" /var/log/auth.log | tail -10
    echo
    echo "=== Users with sudo ==="
    sudo -l | grep -E "^User|^Runas"
    echo
    echo "=== Active services ==="
    systemctl list-units --type=service --state=running | head -20
    echo
    echo "=== Open ports ==="
    ss -tuln | grep LISTEN
} > "$REPORT"

# Send by email
mail -s "Security Report $(date +%Y-%m-%d)" admin@example.com < "$REPORT"

Cron for Monitoring​

# /etc/cron.daily/security-check
#!/bin/bash
# Daily security check

# Rootkit scan
rkhunter --check --skip-keypress

# Check file integrity
# (if AIDE installed)
# aide --check

# Report
/usr/local/bin/security-report.sh

Summary​

In this chapter, you learned:

auditd: Linux audit system, rules, logs
Search: ausearch, aureport for log analysis
Monitoring: Auth logs, last, who, w
Detection: Monitoring scripts, alerts
Tools: fail2ban, rkhunter, chkrootkit
Reports: Security report automation
Practice: Continuous monitoring, alerts, reports

Next Steps​

Module 10: Package Management
Module 11: Monitoring and Logs

Chapter created on: December 2024