[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Dispatcher - single line output (perl)



All,

Some of you may remember the post a month or two back about an audit
dispatcher that converts the output of auditd, into
one-line-per-event/one-event-per-line.

I've reached an alpha state for this program, and would appreciate
comments/suggestions etc.

Features:
* Takes the output from auditd, and migrates the data into something
that is suitable for applications that expect an event to be self
contained on a single line.
* Tries to extrapolate usernames from userids (using an internal cache
if it can, to cut down on the getpw* calls) so that a centralised
audit collection system doesn't have to keep a UID->username mappings
for all systems.
* Turns eventID numbers into event names (multi-arch compatible).
* Filters audit log data based on administrator-configurable objectives.
* Automatically turns on events as appropriate, based on the
administrators defined objectives.
* Internal/Embedded web server for remote control of the audit
configuration, and (to a certain extent) review of the most recently
received audit events. Fully contained within the code - no external
files accessed to build the web pages (except the config file). The
http server can be password protected, and has a basic IP-based access
control capability.
* Sends audit data to a specified IP address/port combination (snare
format, or syslog format), or local file (though this isn't supported
in the web-gui).

Installation:
$ tar xzf SnareLinux-1.0.tar.gz
$ make
# cp /etc/audit.rules /etc/audit.rules-`date "+%Y%m%d"`
# cp /etc/auditd.conf /etc/auditd.conf-`date "+%Y%m%d"`
# make install

# vi /etc/snare.conf
.. uncomment:
  #        allow=1

# /etc/init.d/auditd restart

(make uninstall will revert).

Point a browser at port 6161 of the target machine, and
configure/manage appropriately.

If you don't want to fire up a syslog server, or snare micro server to
receive events, feel free to run something like this for testing:
$ socat udp4-listen:6161,reuseaddr,fork OPEN:/tmp/snare.log,creat,append

Alternatively, manually add the following into the [Output] section of
the config file:
    file=/tmp/snare.log

Developed on RHEL4U2/Centos4U2. Only very basic testing/qa has been
performed so far. I'd be very interested to know if it works 'out of
the box' on any other distros, or if people have any problems with
installation/use.

BTW: Assume the code is fully GPL - I haven't plastered the
notification through the source yet though. :)

Regards,

Leigh.

Attachment: SnareLinux-1.0.tar.gz
Description: GNU Zip compressed data


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]