In this lesson, you will learn how to implement centralized logging to capture every attempt to modify or query your Linux identity infrastructure.
When managing centralized identity—whether through LDAP, SSSD, or Kerberos—the most critical security requirement is visibility. If an administrator modifies a user's UID or if a service account attempts to query the identity provider, you need a tamper-proof audit trail that correlates these events across your environment.
The Role of auditd in Identity Monitoring
While PAM handles the authentication flow, the Linux Audit Framework (auditd) is the engine that watches the changes to the underlying identity files and databases. In a centralized environment, your "identity data" typically lives in files like /etc/nsswitch.conf, /etc/sssd/sssd.conf, or sensitive LDAP credential caches.
To audit changes to your SSSD configuration—the heart of many centralized identity setups—you should add a watch rule to your audit.rules file:
# Monitor changes to SSSD configuration files
-w /etc/sssd/sssd.conf -p wa -k identity_mod
Correlating PAM and Identity Events
To get a full picture, you must combine these file-system audits with PAM logging. By configuring the pam_tty_audit.so module, you can capture the exact commands run during sensitive identity changes, ensuring that every time a user elevates their privileges to modify identity attributes, the session activity is logged to journald or your centralized Syslog server.
Add this line to your /etc/pam.d/system-auth file to enable granular TTY auditing for users:
session required pam_tty_audit.so disable=* enable=admin_user
By pairing auditd rules (which track file modifications) with pam_tty_audit (which tracks the intent and input of the administrator), you create a robust "identity breadcrumb" trail. If a UID is changed or a group membership is altered, your logs will tell you exactly which file changed, who changed it, and what commands they typed to finalize the process.
Key Takeaway: Centralized identity auditing requires a two-pronged strategy: using auditd to track static configuration changes and PAM-level session auditing to capture the active behavior of administrators modifying identity data.