I-Linux Audit Framework: Konke Mayelana ne-Auditd Command

Ezinsukwini ezimbalwa ezedlule, ekuqaleni kukaFebhuwari, sishicilele okuthunyelwe okukhethekile okubonisa iqoqo elikhulu lemiyalo ebalulekile (eyisisekelo nephakathi) etholakala ezinhlelweni eziningi zokusebenza zamahhala nezivulekile ezisekelwe ku-GNU/Linux. Eminye yayilula kakhulu, ikuvumela ukuthi ulawule amafolda namafayela futhi ubuke ulwazi lwawo. Eminye yayiyinkimbinkimbi kakhulu, ikwenza ukwazi ukuphatha ukucushwa kanye namapharamitha.

Kodwa-ke, lokhu kuhlanganiswa kumboze imiyalo emincane engu-60 ye-Linux . Futhi njengoba, ngokwesilinganiso, amakhulu emiyalo atholakala ekusakazweni okuningi kwe-GNU/Linux, sekuyisikhathi sokubhekana kancane kancane neminye imiyalo efanayo noma ebaluleke kakhulu, ethuthukisiwe, noma ekhethekile. Njengomyalo we-Linux Auditd , noma "i-Linux Audit Framework ," esizoxoxa ngayo kulokhu okuthunyelwe.

Imiyalo ye-Linux: Okubaluleke kakhulu ukuze ukwazi kahle ngonyaka ka-2023

Kodwa ngaphambi kokuba siqale lokhu okuthunyelwe okuthakazelisayo mayelana nomyalo we-Linux Auditd noma "i-Linux Audit Framework" , sincoma ukuthi ufunde okuthunyelwe kwangaphambilini:

I-athikili ehlobene:

Imiyalo ye-Linux: Okubaluleke kakhulu ukuze ukwazi kahle ngonyaka ka-2023

I-Linux Audit Framework: Imvelo yokuhlola ye-Linux enamandla

Iyini i-Auditd Command (Linux Audit Framework)?

Ngamafuphi, singachaza umyalo we-Auditd njengohlaka lokuhlola lwe-Linux oluhlinzeka ngohlelo lokuhlola oluhambisana ne-CAPP (Controlled Access Protection Profile) . Ngakho-ke, ingaqoqa ulwazi oluthembekile mayelana nanoma yimuphi umcimbi ohlobene nokuphepha (noma ongahlobene) ohlelweni lokusebenza lwe-Linux.

Ngenxa yalokho, ilungele ukusisekela lapho silandelela izenzo ezenziwa ohlelweni lokusebenza. Ngale ndlela, umyalo we-Auditd noma i -Linux Audit Framework (LAF) kungasisiza ukugcina uhlelo lwethu lokusebenza luphephile ngokunikeza amathuluzi adingekayo okuhlaziya okwenzekayo ngaphakathi kwalo ngokuningiliziwe.

Kodwa-ke, njengoba kulindeleke, ayinikezi ukuphepha okwengeziwe ngokwayo ; okungukuthi, ayivikeli uhlelo lwethu lokusebenza ekuphazamisekeni kwekhodi noma yiluphi uhlobo lokuxhashazwa yisofthiwe enonya noma ukuhlaselwa kokungena. Kunalokho, iwusizo ekulandeleleni izinkinga ezingaba khona ukuze kuhlaziywe futhi kulungiswe kamuva , okuvumela ukuthi kuthathwe izinyathelo zokuphepha ezengeziwe ukuze kuncishiswe noma kuvinjelwe. Okokugcina, i-LAF isebenza ngokulalela izehlakalo ezibikwe yi-kernel bese izifaka kufayela lelogi ukuze zihlaziywe kamuva futhi zibikwe kumsebenzisi.

Iyithuluzi lesikhala somsebenzisi lokuhlola ukuphepha. Iphakheji yokuhlola iqukethe izinsiza zomsebenzisi zesikhala sokugcina nokusesha amalogi okuhlola akhiqizwe uhlelo lokuhlola lwe-kernel ye-Linux, kusukela kunguqulo 2.6 kuya phambili. (iphakheji ye-auditd ku-Debian)

Uwufaka futhi uwusebenzise kanjani umyalo we-Auditd?

Njengemiyalo eminingi, nge-Terminal (CLI), ingafakwa kalula futhi njalo kusetshenziswa umphathi wephakheji ozenzakalelayo noma okhethwayo we-GNU/Linux Distro yakho.

Isibonelo, ku -Debian GNU/Linux kanye nama-derivatives kungaba:

sudo apt install auditd

Ngenkathi, ku -Fedora GNU/Linux kanye ne-Red Hat , kanye nezinhlelo zabo ezifanayo, kungaba:

sudo dnf install auditd

sudo yum install audit

Futhi ngokusetshenziswa kwayo okuyisisekelo nokuzenzakalelayo, kuyadingeka kuphela ukwenza imiyalo elandelayo yomyalo:

Hlola isimo sokwenza

sudo systemctl status audit

Nika amandla isevisi yangemuva

sudo systemctl enable auditd

Buka imithetho emisiwe njengamanje

sudo auditctl -l

Ukwakhiwa kwemithetho yokubonisa (iwashi) noma isilawuli (syscall)

sudo auditctl -w /carpeta/archivo -p permisos-otorgados

sudo auditctl -a action,filter -S syscall -F field=value -k keyword

Phatha yonke imithetho edaliwe

sudo vim /etc/audit/audit.rules

Faka kuhlu zonke izehlakalo ezihlobene nenqubo ethile ngokuya nge-PID yayo, igama elingukhiye elihlobene, indlela noma ifayela noma izingcingo zesistimu.

sudo ausearch -p PID

sudo ausearch -k keyword

sudo ausearch -f ruta

sudo ausearch -sc syscall

Khiqiza imibiko yocwaningo

sudo aureport -n

sudo aureport --summary

sudo aureport -f --summary

sudo aureport -l --summary

sudo aureport --failed

Landelela ukwenziwa kwenqubo

sudo autracet /ruta/comando

Noma kunjalo, ukuze ufunde kabanzi ngakho, sincoma ukuhlola izixhumanisi ezilandelayo:

Isifingqo

Ngamafuphi, sithemba ukuthi le ncwadi, ehlobene nendawo enamandla yokuhlola ehlanganiswe ku-GNU/Linux eyaziwa ngokuthi "i-Linux Audit Framework ," enikezwa ngomyalo we -Linux Auditd , izovumela abasebenzisi abaningi ukuthi bahlole (bahlole futhi bahlole) yonke imisebenzi yezinhlelo zabo zokusebenza ezisekelwe ku-GNU/Linux ezikhululekile nezivulekile. Lokhu kuzokwenza bakwazi ukubona kalula futhi balungise ngokushesha noma yikuphi ukucushwa noma imisebenzi engavamile, engafanele, noma eyingozi.

Okokugcina, zizwe ukhululekile ukwabelana ngemicabango yakho ngesihloko sanamuhla kumazwana. Futhi uma ukujabulele lokhu okuthunyelwe, sicela wabelane ngakho nabanye . Futhi, khumbula ukuvakashela ikhasi lethu lasekhaya ku- " DesdeLinux " ukuze uhlole izindaba ezengeziwe, futhi ujoyine isiteshi sethu esisemthethweni se-DesdeLinux Telegram noma leli qembu ukuze uthole ulwazi olwengeziwe ngesihloko sanamuhla.