Lesson 5.8: Auditing with auditd
The Linux audit system records security-relevant events at the kernel level: who changed which file, who ran what, with which login identity, even through sudo. How watch rules work, why the audit UID (auid) matters, how to search events with ausearch, and how to make rules permanent. In the lab you add watches on sudoers and the account files and immediately find an entry from 03:41 last night: the forgotten test account, through sudo, wrote a sudoers file granting itself passwordless root and created a user. You read the evidence, remove the backdoor and lock the account.
17 min
You will learn to
- Explain what auditd records
- Add file watch rules with auditctl
- Explain the audit UID (auid)
- Search events with ausearch
- Make rules persistent
Key terms
- auditd
- The Linux audit daemon: writes kernel-level security events to /var/log/audit/audit.log.
- Watch rule
- An audit rule that records access to a file or folder.
- auid (audit UID)
- The ID of the user who originally logged in, kept unchanged through sudo and su.
- ausearch and aureport
- Tools to search audit logs (by key, user, time, file) and summarise them.
← DNS: the internet's phone book · All lessons · Server-side request forgery (SSRF) →