Skip to main content

Lab 9.4 - Security Audit and Monitoring

Objectives​

  • Use auditd
  • Monitor access attempts
  • Analyze security logs

Exercise 1: auditd​

# Install
sudo apt install auditd

# View rules
sudo auditctl -l

# Add a rule
sudo auditctl -w /etc/passwd -p rwxa -k passwd_access

Lab created on: December 2024 - Tested on Ubuntu 24.04