I am on Ubuntu 20.04 Server. I have auditd installed and configured.
Question
How can enable TTY logging via auditd?
In /etc/auditd/rules.d/audit.rules I have:
-w /etc/securetty -p wa -k login
-w /dev/tty -p rwxa -k tty -F uid!=0
In /etc/pam.d/common-password and /etc/pam.d/common-auth I have:
session required pam_tty_audit.so enable=* disable=adminuser log_passwd
Problem:
After I ssh into the server as a non-admin user & execute commands the output of aureport --tty is always blank.
Update
When in doubt, check the dang log.:
type=SYSCALL msg=audit(1673536130.491:301): arch=c000003e syscall=44 success=yes exit=56 a0=3 a1=7ffdd0aaf0e0 a2=38 a3=0 items=0 ppid=819 pid=834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" key=(null)
It seems that my kernel (linux-image-5.4.0-138-generic) does not support auditing tty
#grep -E "^CONFIG_AUDIT_CONTROL=y|^CONFIG_AUDIT_TTY=y" /usr/lib/modules/$(uname -r)/build/.config
#
More Mystery:
I incorrectly assumed that the CONFIG_AUDIT and CONFIG_AUDIT_TTY not being activated in the kernel were the result of something that I did, so I re-installed my current kernel and rebooted, assuming that the default settings would return:
apt-get install --reinstall linux-image-5.4.0-138-generic
Correction
The auditd log file now shows:
type=EXECVE msg=audit(1673605183.202:290911): argc=4 a0="grep" a1="--color=auto" a2="tty" a3="/var/log/audit/audit.log"
type=SYSCALL msg=audit(1673605183.202:290912): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7ffe12a5b784 a2=100 a3=0 items=1 ppid=4009 pid=217617 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 **tty=pts1** ses=6 comm="grep" exe="/usr/bin/grep" key="auditlog"
Indicating that kernel options tty auditing are enabled. However, I have no way to actually verify that beyond the log file.
Is this a problem with the packaged kernel available at the repo?
I still get:
#grep -E "^CONFIG_AUDIT_CONTROL=y|^CONFIG_AUDIT_TTY=y" /usr/lib/modules/$(uname -r)/build/.config
#
More odd, but progress
this command aureport --tty | grep $(id -u username) now sometimes results sometimes does not return results (mostly not)...
Could the "hit" or "miss" nature of the results be related to logfile rotation? perhaps auditd is rotating files more often than necessary for it to be useful?.... hhmm
