在RHEL6上针对rm命令做审计

最新推荐文章于 2025-03-16 22:11:09 发布

msdnchina

最新推荐文章于 2025-03-16 22:11:09 发布

阅读量1.1k

点赞数

CC 4.0 BY-SA版权

文章标签： Linux rm audit 审计

本文链接：https://blog.youkuaiyun.com/msdnchina/article/details/52461559

RHEL6 同时被 2 个专栏收录

117 篇文章

订阅专栏

OL6

48 篇文章

订阅专栏

本文介绍了如何在RHEL6系统中配置审计规则以记录rm命令的使用情况，并通过实例展示了从创建审计策略到查看审计结果的全过程。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

第一:建立针对rm的审计策略:


[root@rhel63single ~]# cat /etc/audit/audit.rules
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.


# First rule - delete all
-D


# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320


# Feel free to add below this line. See auditctl man page
-a exit,always -F arch=b64 -S execve -F path=/bin/rm -k rm                ---------->>>此行是新加的.
[root@rhel63single ~]# auditctl -l
No rules
[root@rhel63single ~]# service auditd restart
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]
[root@rhel63single ~]# auditctl -l
LIST_RULES: exit,always arch=3221225534 (0xc000003e) watch=/bin/rm key=rm syscall=execve       ---------->>>>审计规则生效.

第二:执行rm操作:

[root@rhel63single ~]# touch wokao
[root@rhel63single ~]# rm -rf wokao
[root@rhel63single ~]# date
Mon Aug 15 00:46:21 CST 2016
[root@rhel63single ~]# pwd
/root
[root@rhel63single ~]#

第三:查看审计的结果:

[root@rhel63single ~]# ausearch -k rm
----
time->Mon Aug 15 00:43:41 2016
type=CONFIG_CHANGE msg=audit(1471193021.597:336): auid=0 ses=23 subj=unconfined_u:system_r:auditctl_t:s0 op="add rule" key="rm" list=4 res=1
----
time->Mon Aug 15 00:45:32 2016  ------>>>执行rm操作的时间
type=PATH msg=audit(1471193132.902:337): item=1 name=(null) inode=401817 dev=08:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0
type=PATH msg=audit(1471193132.902:337): item=0 name="/bin/rm" inode=6106 dev=08:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0
type=CWD msg=audit(1471193132.902:337):  cwd="/root"  ---->>>当前所在目录
type=EXECVE msg=audit(1471193132.902:337): argc=4 a0="rm" a1="-i" a2="-rf" a3="wokao"----->>>wokao是文件名
type=SYSCALL msg=audit(1471193132.902:337): arch=c000003e syscall=59 success=yes exit=0 a0=1b175a0 a1=1b15d80 a2=1af3e00 a3=28 items=2 ppid=2926 pid=7288 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="rm"
[root@rhel63single ~]#

参考文档:
Oracle Linux 5 - Audit rules to log reboot command executions (文档 ID 2094229.1)

参考文档: