Installing and Configuring Auditd

This document describes how to install auditd in an Ubuntu an or CentOS like OS. It will configure auditd to log messages for effective security monitoring.

This requires sudo access.

Prerequisites

To ensure log delivery to Microsoft Sentinel, the Log Analytics agent should already be configured to send Audit logs to Sentinel

Procedures to follow to ingest custom logs with Log Analytics agent

Installation

# For systems with APT
sudo apt install -y auditd curl

# For systems with YUM
sudo yum -y install auditd curl

Configuration

Create the rule file.

sudo touch /etc/audit/rules.d/quantum_auditd.rules
sudo chown root:root /etc/audit/rules.d/quantum_auditd.rules
sudo chmod 640 /etc/audit/rules.d/quantum_auditd.rules
sudo vi /etc/audit/rules.d/quantum_auditd.rules

We edit the file quantum-sec.rules to add Armor Security verified rules. These rules can be found in auditd-config repository

Edit the configuration file

sudo vi /etc/audit/auditd.conf

We replace the contents of the file with Armor Security’s best practice configuration. This configuration can be found in auditd-config repository

There are some configurations that are only available for Auditd 3.0 and later. These are commented out by default. If the Linux distro has Auditd 3.0 installed, then we should uncomment these. Run sudo auditctl -v to check the version of the Audit that’s running.

Configuration that are only available in the 3.0 and later have been commented in the conf file with the string ## DO NOT REMOVE!!! AUDITD 3.0 ONLY ## (e.g. configuration like disp_qos). These lines should be uncommented.

Restart service

Finally, we restart the auditd service:

sudo service auditd restart

Fine tuning Auditd buffer size

The buffer size will need to be fine tuned. It is set at 8 MB, but it should be increased for systems that are very busy.

Check the lost count

$ sudo auditctl -s
enabled 1
failure 1
pid 1710
rate_limit 1000
backlog_limit 8192
lost 3377
backlog 0
loginuid_immutable 0 unlocked

A non zero count shows some events were lost, and that we need to increase the buffer size.

Increase the buffer size

$ sudo vi /etc/audit/rules.d/quantum_auditd.rules

Modify the below line to increase it from 8 MB

-b 8192

Then restart auditd

sudo service auditd restart

Reset the lost count

$ sudo auditctl -s --reset-lost

There will be a few events lost during startup, but the idea is to run auditctl -s several times after startup and make sure it’s not incrementing exponentially and is staying stable.

NOTE: “auditctl -s –reset-lost” only works on auditd versions 2.x and up. It will not work on Ubuntu 20.04 1.x versions of auditd.