Auditing Privileged Command Execution with Auditd

You will capture every command executed by administrative users to maintain an immutable audit trail.

In this lesson, you will learn how to configure the Linux Audit framework (auditd) to generate an immutable trail of every command executed by users with administrative privileges.

Why Audit Privileged Users?

While sudo logs command execution to syslog, these logs can be tampered with if a root user gains full control over the system. By using auditd, we interface directly with the kernel to intercept system calls, providing a much higher level of assurance. This creates a forensic-grade record that is difficult to bypass, even for an administrator.

Implementing the Audit Rules

To capture privileged activity, we look for users with a User ID (UID) of 0 (root) or those using sudo. We define these rules in /etc/audit/rules.d/audit.rules.

Add the following rule to ensure every execve system call (which executes a program) is logged when performed by a privileged user:

# Audit any command executed by root
-a always,exit -F arch=b64 -F euid=0 -S execve -k privileged_commands

# Audit usage of sudo by any user
-w /usr/bin/sudo -p wa -k sudo_log

-a always,exit: Forces the kernel to log the event upon system call exit.
-F arch=b64: Filters for 64-bit architecture.
-F euid=0: Targets events where the Effective User ID is root.
-S execve: Specifies the system call to monitor.
-k: Assigns a key (label) to the audit record, making it easy to search later using ausearch -k privileged_commands.

Maintaining Immutability

To prevent an administrative user from simply disabling the audit daemon to cover their tracks, you should make the audit configuration "immutable" by adding the following line to the end of your audit.rules file:

-e 2

Once this is set, the audit configuration cannot be changed until the system is rebooted. This ensures that your trail remains intact regardless of what the logged-in administrative user attempts to modify within the audit subsystem.

Key Takeaway: By binding audit rules to the kernel’s execve system call and setting the configuration to immutable mode, you create a tamper-resistant record of all administrative actions that is essential for compliance and forensic integrity.