Re: root shell auditing

Marian Rudzynski wrote:
> Hari Sekhon wrote:
>> Diego Lacerda wrote:
>>> Hi, Mars,
>>>
>>> I think that you could use Linux Process Accounting to audit
>>> everything that you need in a shell environment.
>>>   
>> I've tried this, it lacks some detail if I remember correctly it 
>> doesn't log params as it was designed for process accounting, not 
>> security auditing, which could mean missing a lot as sometimes it's 
>> the parameters that make all the difference between a normal and a 
>> dangerous action.
>>
>> So far for me, snoopy comes closest.
>>
>> -h
>>
> The Kernel accounting/audit might actually be the only real thing here 
> though.
>
> I'm currently in need of a thourough accouting/auditing setup myself 
> and I haven't managed to find anything that does the job as needed 
> (e.g. secure)
>
> Snoopy hasn't been maintained for a long time and segfaults on x86_64, 
> "linuxbsm" (an attempt to create a Linux Basic Security Module) hasn't 
> been maintained since 2001 either and bash patches just won't suffice.
>
> So if anyone knows of any other reasonably secure and practicable way 
> to do these things, recommend it. My guess is kernel accounting/audit 
> is the way to go however.
>
Ok but that also won't do what you want. I could tell you that cat was 
run but it wouldn't tell you what the args where to know if someone used 
it to overwrite or append to some file critical to the security of your 
system (or just accidentally catted over the wrong file and lost the 
contents...)

I'm also watching this space very closely for an open source champion to 
spring up for this auditing challenge.


Perhaps you could force everybody to use sudo for every command that 
requires root privs and have automated alerting if anyone does a direct 
root login or a sudo su or an sudo (/usr)?/bin/shell_of_your_choice type 
thing...

sudo does log properly and if all commands go through it, then you win. 
This way all root commands would either be logged or you'd be alerted to 
someone intentionally circumventing the logging by getting a full root 
shell.


So far nothing I've seen in open source has gotten the whole picture of 
external progs, shell built-ins, and cli args to be completely covered.

There are a couple of proprietary solutions I've seen that solve this 
problem by forcing you to connect to your servers through their box so 
they can record every keystroke and session output, but I think they are 
far from cheap.

The idea of entire session capture is a pretty good one though as it 
makes it very difficult to circumvent by doing things like spawning a 
different shell to get around the logging bash patch...

-h

-- 
Hari Sekhon