《auditd 审计、合规基线与入侵取证实战》

应用系统调用 → 内核 audit 模块（按规则过滤）
   ↓ netlink
auditd 守护进程
   ├─→ /var/log/audit/audit.log
   └─→ audispd 插件 → 远程/SIEM

# 安装与启用
apt install auditd audispd-plugins     # Debian/Ubuntu
yum install audit auditd               # RHEL/CentOS
systemctl enable --now auditd
auditctl -s                            # 查看状态

auditctl -w /etc/passwd -p wa -k identity
auditctl -w /etc/shadow -p wa -k identity
auditctl -w /etc/sudoers -p wa -k sudoers
auditctl -w /etc/ -p wa -k etc_change

# 监控执行（用 auid 过滤真实用户，避免全量）
auditctl -a always,exit -F arch=b64 -S execve -F auid>=1000 -k exec_all
# 监控文件删除与重命名
auditctl -a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -k delete
# 监控权限位修改与提权
auditctl -a always,exit -F arch=b64 -S chmod -S fchmod -k perm_mod
auditctl -a always,exit -F arch=b64 -S setuid -S setgid -k priv_esc

auditctl -l                    # 查看已加载规则
auditctl -D                    # 删除所有规则（慎用）
auditctl -W /etc/passwd -p wa -k identity   # 按 key 删除

auditctl -w /etc/cron.d/ -p wa -k persistence
auditctl -w /etc/systemd/system/ -p wa -k persistence
auditctl -w /root/.ssh/ -p wa -k persistence
auditctl -w /etc/ld.so.preload -p wa -k persistence
auditctl -w /usr/bin/sudo -p x -k priv_esc
auditctl -a always,exit -F arch=b64 -S init_module -S delete_module -k modules

# 网络连接（区分成功/失败）
auditctl -a always,exit -F arch=b64 -S connect -k network_connect
# 读取敏感文件
auditctl -w /etc/shadow -p r -k shadow_read
# 挂载与卸载
auditctl -a always,exit -F arch=b64 -S mount -S umount2 -k mount

ausearch -k identity                    # 按 key 检索
ausearch -ts today -k priv_esc          # 按时间 + key
ausearch -ua 1000                       # 按审计用户
ausearch -p 12345                       # 按进程号
ausearch -sc execve                     # 按系统调用
ausearch -m SYSCALL -sv no              # 只找失败
ausearch -i -k identity                 # 解析为可读文本

aureport --summary          # 总体摘要
aureport -l                 # 登录报表
aureport -au --failed       # 认证失败
aureport -x                 # 执行命令报表
aureport -f                 # 文件访问报表
aureport -u                 # 按用户统计

# 组合：今天所有提权失败
ausearch -ts today -k priv_esc -sv no -i
# 本周登录失败最多的用户
aureport -au --failed -ts this-week

# /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log
flush = INCREMENTAL
freq = 20
num_logs = 10
max_log_file = 50            # 单个日志最大 MB
max_log_file_action = ROTATE
space_left_action = SYSLOG
admin_space_left_action = SUSPEND   # 磁盘将满时暂停审计
disk_full_action = SUSPEND

# /etc/audit/plugins.d/au-remote.conf
active = yes
direction = out
path = /sbin/audisp-remote
type = always
# /etc/audit/audisp-remote.conf
remote_server = 10.0.0.100
port = 60
transport = tcp
mode = immediate

ss -lntup | grep :60                                  # 验证接收端
sha256sum /var/log/audit/audit.log* > /root/audit-hash.txt

# /etc/audit/rules.d/99-hardening.rules（节选）
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k scope
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
-a always,exit -F arch=b64 -S setuid -S setgid -k priv_esc
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -k delete
-a always,exit -F arch=b64 -S execve -F auid>=1000 -k exec
-e 2

augenrules --load              # 加载规则
auditctl -s | grep enabled     # 确认为 2（不可变）

auditctl -s                              # 1. 确认审计未被关闭或清空
aureport -ts this-week --summary         # 2. 建立时间基线，找异常时段
aureport -au --failed -ts this-week      # 3. 查可疑登录与认证失败
ausearch -k priv_esc -ts this-week -i    # 4. 查提权行为
ausearch -k exec -ts this-week -i | grep -iE 'nc |/dev/tcp|curl|wget'
ausearch -k persistence -ts this-week -i # 5. 查持久化落点
ausearch -k network_connect -ts this-week -i  # 6. 查外联

ps auxf | grep -vE '\[.*\]'              # 可疑进程
ss -lntup                                # 监听端口
crontab -l; ls -la /etc/cron.*/          # 异常定时任务
awk -F: '$3==0' /etc/passwd              # 异常 UID=0 账户
cat /root/.ssh/authorized_keys           # 异常密钥
find /tmp /var/tmp /dev/shm -type f -mtime -7 -ls   # 近期可疑文件
lsmod; ls -la /etc/ld.so.preload         # rootkit 痕迹

-w /var/lib/mysql/ -p rw -k db_access                          # 敏感数据访问
-a always,exit -F arch=b64 -S chmod -S chown -S setxattr -k perm_mod
-a always,exit -F arch=b64 -S adjtimex -S clock_settime -k time_change
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_mod
-w /etc/audit/ -p wa -k audit_config                           # 审计配置自身

# 1. 用 auid 过滤真实用户，避免全量 execve
-a always,exit -F arch=b64 -S execve -F auid>=1000 -F auid!=4294967295 -k exec
# 2. 只记失败，减少日志量
-a always,exit -F arch=b64 -S open -F success=0 -k open_fail
# 3. 只监控写操作，不监控读
-w /etc/ -p wa -k etc_change

auditctl -s                                # 队列与丢失事件
grep -E 'backlog|rate' /etc/audit/auditd.conf
du -sh /var/log/audit/                     # 日志增长速率