Lesson 2.72: Protecting the audit trail
An audit trail is only useful if it's still there and complete when you need it. Attackers with root try to switch rules off, and a full disk can silently stop logging. auditd can keep every log file, react before the disk fills, send each record to a remote server as it's written, and lock its rules so that even root can't change them until the next reboot. In the lab you harden Northwind's HR server: fix the disk-space actions, turn on remote forwarding, make the rules immutable and prove they can't be removed.
17 min
You will learn to
- Read auditd.conf's log and disk-space settings
- Choose actions that never silently stop logging
- Enable remote forwarding with audisp-remote
- Make rules immutable with -e 2
- Verify immutability
Key terms
- max_log_file_action
- What auditd does when a log file reaches max_log_file: ROTATE (delete the oldest) or keep_logs.
- space_left / admin_space_left
- Free-space thresholds (MB) with their own actions: syslog, email, single, halt, suspend.
- disk_full_action
- What happens when the disk is full; SUSPEND silently stops recording.
- audisp-remote
- An audit plugin that sends each record to a remote auditd or SIEM.
- Immutable rules (-e 2)
- After -e 2, no rule can be added, removed or disabled until reboot.
← Rootless containers and user namespaces · All lessons · Hidden kernel modules and system call hooks →