https://github.com/Neo23x0/auditd
Best Practice Auditd Configuration
https://github.com/Neo23x0/auditd
Last synced: 12 months ago
JSON representation
Best Practice Auditd Configuration
- Host: GitHub
- URL: https://github.com/Neo23x0/auditd
- Owner: Neo23x0
- License: apache-2.0
- Created: 2018-09-25T07:16:21.000Z (over 7 years ago)
- Default Branch: master
- Last Pushed: 2025-01-31T16:26:52.000Z (about 1 year ago)
- Last Synced: 2025-03-24T01:37:34.718Z (12 months ago)
- Size: 209 KB
- Stars: 1,584
- Watchers: 83
- Forks: 275
- Open Issues: 46
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Audit: audit.rules
Awesome Lists containing this project
- sg-awesome - Auditd-Best-Practices - audit.rules file containing best practice rules. (Tools/Scripts/Code:)
- awesome-security-hardening - Neo23x0/auditd - Best Practice Auditd Configuration (GNU/Linux)
- awesome-starred - Neo23x0/auditd - Best Practice Auditd Configuration (Others)
- awesome-csirt - auditd
README
[](https://gist.github.com/cheerfulstoic/d107229326a01ff0f333a1d3476e068d)
___ ___ __ __
/ | __ ______/ (_) /_____/ /
/ /| |/ / / / __ / / __/ __ /
/ ___ / /_/ / /_/ / / /_/ /_/ /
/_/ |_\__,_/\__,_/_/\__/\__,_/
Best Practice Auditd Configuration
## Idea
The idea of this auditd configuration is to provide a basic configuration that
- works out-of-the-box on all major Linux distributions
- fits most use cases
- produces a reasonable amount of log data
- covers security relevant activity
- is easy to read (different sections, many comments)
## Sources
The configuration is based on the following sources
Gov.uk auditd rules
https://github.com/gds-operations/puppet-auditd/pull/1
CentOS 7 hardening
https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon
Linux audit repo
https://github.com/linux-audit/audit-userspace/tree/master/rules
Auditd high performance linux auditing
https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/
### Further rules
Not all of these rules have been included.
For PCI DSS compliance see:
https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules
For NISPOM compliance see:
https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules
## Video Explanations by IppSec
IppSec captured a video that explains how to detect the exploitation of the OMIGOD vulnerability using auditd. In that video, he walks you through the audit configuration maintained in this repo and explains how to use it. I highly recommend this video to get a better understanding of what is happening in the config.
https://www.youtube.com/watch?v=lc1i9h1GyMA
## Contribution
Please contribute your changes as pull requests