Generating Linux audit reports

Generating Linux audit reports

Generating Linux audit reports Audit reports are very crucial whenever we want to catch / track an incident and user activity on Linux machine. All the audit logs are going to save in /var/log/audit/ directory, when we see them directly we may understand them in correct way and in required fashion in order read all the logs and generate an beautiful reports using aureport utility allows you to generate summary and columnar reports on the events recorded in audit log files. Generating Linux audit reports

Summary report of all the activities

Executable files report

Terminal activity reports

Authentication report

Commands run report

Config change report

Crypto report

Remote Host name report

Integrity event report

Login report

Modification to accounts report

Mandatory Access Control (MAC) report

Pid report

Syscall report

Log time range report

Report about tty keystrokes

Virtualization report

AVC Audit Events – These are generated by the AVC subsystem as a result of access denials, or where specific events have requested an audit message (i.e. where an auditallow rule has been used in the policy).

1. Summary audit report of given range

To generate a report fro logged events in the fast 10 days excluding the current example day, use the following command as mentioned in below

[root@TechTutorial ~]# aureport --start 01/04/2016 00:00:00 --end 01/28/2016 00:00:00

Summary Report

======================

Range of time in logs: 01/08/2016 22:47:49.346 - 01/27/2016 17:30:01.670

Selected time for report: 01/04/2016 00:00:00 - 01/28/2016 00:00:00

Number of changes in configuration: 6942

Number of changes to accounts, groups, or roles: 18

Number of logins: 36

Number of failed logins: 14

Number of authentications: 111

Number of failed authentications: 17

Number of users: 4

Number of terminals: 12

Number of host names: 4

Number of executables: 14

Number of commands: 68

Number of files: 1

Number of AVC's: 1

Number of MAC events: 36

Number of failed syscalls: 0

Number of anomaly events: 1

Number of responses to anomaly events: 0

Number of crypto events: 745

Number of integrity events: 0

Number of virt events: 0

Number of keys: 0

Number of process IDs: 1866

Number of events: 17019

in above command range is starting from Jan/4th/2016 ends with Jan/28th/2016

2. Executable file events

To generate a report of all executable file events, use the below command as shown

[root@TechTutorial ~]# aureport -x

Executable Report

====================================

# date time exe term host auid event

====================================

1. 01/08/2016 22:47:49 /usr/lib/systemd/systemd ? ? -1 6

2. 01/08/2016 22:47:49 /usr/lib/systemd/systemd-update-utmp ? ? -1 7

3. 01/08/2016 22:47:49 /usr/lib/systemd/systemd ? ? -1 8

4. 01/08/2016 22:47:49 /usr/lib/systemd/systemd ? ? -1 9

5. 01/08/2016 22:47:49 /usr/lib/systemd/systemd ? ? -1 10

6. 01/08/2016 22:47:49 /usr/lib/systemd/systemd ? ? -1 11

7. 01/08/2016 22:47:49 /usr/lib/systemd/systemd ? ? -1 12

8. 01/08/2016 22:47:49 /usr/lib/systemd/systemd ? ? -1 13

9. 01/08/2016 22:47:50 /usr/lib/systemd/systemd ? ? -1 14

10. 01/08/2016 22:47:50 /usr/lib/systemd/systemd ? ? -1 15

3. Executable file events summary report

As we see in above 2 step we can get all the executable file events the same if you want to see in summarized format use below command

[root@TechTutorial ~]# aureport -x --summary

Executable Summary Report

=================================

total  file

=================================

6992  /usr/sbin/xtables-multi

4932  /usr/sbin/crond

3267  /usr/lib/systemd/systemd

1129  /usr/sbin/sshd

240  /usr/bin/kmod

165  /usr/libexec/gdm-session-worker

73  /usr/bin/su

65  /usr/lib/systemd/systemd-update-utmp

16  /usr/bin/passwd

10  /usr/sbin/useradd

9  /usr/bin/sudo

3  /usr/sbin/usermod

2  /usr/bin/crontab

2  /usr/sbin/groupadd

4. Failed User Summary Report

To generate a summary report of failed events for all users, use the following command

[root@TechTutorial ~]# aureport -u --failed --summary -i

Failed User Summary Report

===========================

total  auid

===========================

68  unset

25  rankam

3  root

5. Failed login attempts report per each system user

Generate a summary of all failed login attempts per each system user, use the below command as shown in example

[root@TechTutorial ~]# aureport --login --summary -i

Login Summary Report

============================

total  auid

============================

176  root

12  unset

6  ravi

2  aavi

6. Search all file access events for particular user

generate a report from an ausearch query that searches all file access events for user 0 (root), use the following command as shown below

[root@TechTutorial ~]# ausearch --start today --loginuid 0 --raw | aureport -f --summary

File Summary Report

===========================

total  file

===========================

<no events of interest were found>

7. Log time range report

In order to know your current log available range use following command

[root@TechTutorial ~]# aureport -t

Log Time Range Report

=====================

/var/log/audit/audit.log: 01/08/2016 22:47:49.346 - 01/28/2016 17:20:01.265

8. Modifications to accounts report

This below command will give us the report about modified user accounts

[root@TechTutorial ~]# aureport -m

Account Modifications Report

=================================================

# date time auid addr term exe acct success event

=================================================

1. 01/09/2016 17:31:20 0 ? pts/1 /usr/sbin/useradd ravi yes 570

2. 01/09/2016 17:31:20 0 ? pts/1 /usr/sbin/useradd ? yes 571

3. 01/09/2016 17:31:20 0 ? pts/1 /usr/sbin/useradd ? yes 572

4. 01/09/2016 17:31:28 0 ? pts/1 /usr/bin/passwd ravi yes 573

5. 01/09/2016 17:31:28 0 ? pts/1 /usr/bin/passwd ? yes 574

6. 01/13/2016 15:13:02 0 ? pts/0 /usr/sbin/groupadd ? yes 443

7. 01/13/2016 15:13:02 0 ? pts/0 /usr/sbin/groupadd ? yes 444

8. 01/13/2016 15:14:41 0 ? pts/0 /usr/sbin/useradd ? yes 445

9. 01/13/2016 15:14:41 0 ? pts/0 /usr/sbin/useradd ? yes 446

10. 01/14/2016 14:38:36 0 ? pts/0 /usr/sbin/useradd ? yes 536

9. Reports about process ID's

below report will gives you the date and time when the process has been run

[root@TechTutorial ~]# aureport --pid

Process ID Report

======================================

# date time pid exe syscall auid event

======================================

1. 01/08/2016 22:47:49 614 ? 0 -1 6513

2. 01/08/2016 22:47:49 1 /usr/lib/systemd/systemd 0 -1 6

3. 01/08/2016 22:47:49 638 /usr/lib/systemd/systemd-update-utmp 0 -1 7

4. 01/08/2016 22:47:49 1 /usr/lib/systemd/systemd 0 -1 8

5. 01/08/2016 22:47:49 1 /usr/lib/systemd/systemd 0 -1 9

6. 01/08/2016 22:47:49 1 /usr/lib/systemd/systemd 0 -1 10

7. 01/08/2016 22:47:49 1 /usr/lib/systemd/systemd 0 -1 11

8. 01/08/2016 22:47:49 1 /usr/lib/systemd/systemd 0 -1 12

9. 01/08/2016 22:47:49 1 /usr/lib/systemd/systemd 0 -1 13

10. 01/08/2016 22:47:50 1 /usr/lib/systemd/systemd 0 -1 14

10. Host report

[root@TechTutorial ~]# aureport -h |less

Host Report

===================================

# date time host syscall auid event

===================================

1. 01/08/2016 22:47:49 ? 0 -1 6

2. 01/08/2016 22:47:49 ? 0 -1 7

3. 01/08/2016 22:47:49 ? 0 -1 8

4. 01/08/2016 22:47:49 ? 0 -1 9

5. 01/08/2016 22:47:49 ? 0 -1 10

6. 01/08/2016 22:47:49 ? 0 -1 11

7. 01/08/2016 22:47:49 ? 0 -1 12

8. 01/08/2016 22:47:49 ? 0 -1 13

9. 01/08/2016 22:47:50 ? 0 -1 14

10. 01/08/2016 22:47:50 ? 0 -1 15

11. Reports about configuration changes

if you want to track your system wide configuration changes you can go ahead and generate below type of report

[root@TechTutorial ~]# aureport --config 

Config Change Report

===================================

# date time type auid success event

===================================

1. 01/08/2016 22:47:49 CONFIG_CHANGE -1 yes 5

2. 01/08/2016 23:05:02 NETFILTER_CFG -1 yes 35

3. 01/08/2016 23:05:02 NETFILTER_CFG -1 yes 36

4. 01/08/2016 23:05:02 NETFILTER_CFG -1 yes 37

5. 01/08/2016 23:05:02 NETFILTER_CFG -1 yes 38

6. 01/08/2016 23:05:02 NETFILTER_CFG -1 yes 40

7. 01/08/2016 23:05:02 NETFILTER_CFG -1 yes 41

8. 01/08/2016 23:05:02 NETFILTER_CFG -1 yes 42

9. 01/08/2016 23:05:02 NETFILTER_CFG -1 yes 43

10. 01/08/2016 23:05:02 NETFILTER_CFG -1 yes 44

12. Keystroke report

The audit.log file contains all keystrokes entered by the specified user, including backspaces, delete and return keys, the control key and others. Although the contents of audit.log are human-readable it might be easier to use the aureport utility, which provides a TTY report in a format which is easy to read. You can use the following command as root:

[root@TechTutorial ~]# aureport --tty

TTY Report

===============================================

# date time event auid term sess comm data

===============================================

<no events of interest were found>

We can generate lot many reports using this aureport command below are the options Generating Linux audit reports Generating Linux audit reports Generating 

Linux audit reports

       -a,–avc                       Avc report

       -au,–auth                     Authentication report

       –comm                         Commands run report

       -c,–config                     Config change report

       -cr,–crypto                   Crypto report

       -e,–event                     Event report

       -f,–file                       File name report

       –failed                       only failed events in report

       -h,–host                       Remote Host name report

       –help                         help

       -i,–interpret                 Interpretive mode

       -if,–input <Input File name>   use this file as input

       –input-logs                   Use the logs even if stdin is a pipe

       –integrity                     Integrity event report

       -l,–login                     Login report

       -k,–key                       Key report

       -m,–mods                       Modification to accounts report

       -ma,–mac                       Mandatory Access Control (MAC) report

       -n,–anomaly                   anomaly report

       -nc,–no-config                 Don't include config events

       –node <node name>             Only events from a specific node

       -p,–pid                       PID report

       -r,–response                   Response to anomaly report

       -s,–syscall                   Syscall report

       –success                       only success events in report

       –summary                       sorted totals for main object in report

       -t,–log                       Log time range report

       -te,–end [end date] [end time] ending date & time for reports

       -tm,–terminal                 Terminal name report

       -ts,–start [start date] [start time]   starting data & time for reports

       –tty                           Report about tty keystrokes

       -u,–user                       User name report

       -v,–version                   Version

       –virt                         Virtualization report

       -x,–executable                 executable name report

       If no report is given, the summary report will be displayed

Please provide your valuable feedback…

Red Hat Enterprise Linux 7.2 Installation Guide

Red Hat Enterprise Linux 7.2 Installation Guide. RHEL 7.

Power on Remote Server - Sending an magic packet

Power on Remote Server

As you think today’s technology, we are working from remote locations. Physical server will locate somewhere in thousands of miles long. If you think an emergency situations such as server is shutdown UN-unexpectedly it’s  may due to power issue, it’s may be due to cooling issue and so an.. in this situation you have to wait for the engineer who will come and switch on the server. If you think this server is serving the data for the production then..!! Don’t worry by doing below steps you can switch on your remote server without having the physical access to it.
By mistake, when you shutdown a system instead of rebooting, you can use Wake-on-LAN to power on the server remotely. Also, If you have a server that don’t need to be up and running 24×7, you can turn off and turn on the server remotely anytime you want.
We have to enable the Wake on LAN using magic packet settings in BIOS and NIC settings.

• You can use Wakeonlan when a machine is connected to LAN, and you know the MAC address of that machine.
• Your NIC should support wakeonlan feature, and it should be enabled before the
  shut down. In most cases, by default wakeonlan is enabled on the NIC.

BIOS Settings


In Windows Operating System
Go To. Start –> Computer –>Right Click –> Manage –> Device Manager –> Select Ethernet –> Right Click

Device Manager – NIC Settings

In MAC Operating System


In Linux Operating System

~$ sudo apt-get install ethtool 
~]# yum install wol*
~]# ethtool ens33

option d = disabled
option g = enabled

# ethtool -s eth0 wol g

After all the above settings are done. Download and install application below application for windows OS.
Select Language and Click Ok

Click Next
Click Next
Click Next
Click Next
Click on Install

open application and File menu –> New Host

Install wakeonlan package for ubuntu

$ apt-get install wakeonlan
$ wakeonlan 00:1f:d0:e8:c1:24
Sending magic packet to 255.255.255.255:9 with 00:1f:d0:e8:c1:24

using above command we can send and magic packet
Install wol package for RHEL / Centos / Fedora / Linux Mint

# yum install wol*

Please provide your valuable comments…

Restore System Default Permissions - Linux

Restore System Default Permissions - Linux

I recently came across a system which had some directories set to 777(recursively), the sysadmin needed to install an application and changed all the permissions a mess, I didn’t know where to start, i find one rpm has a parameter called --setperms and --setugids. most useful stuff when you face above situation.

I created a one liner that does the job, it takes time but It works. The same i want to share below is the one, to run this you have to have an sudo access either root access.

1) To reset uids and gids on files and directories :

~]# for u in $(rpm -qa); do rpm --setugids $u; done

2) To permissions on files and directories

~]# for p in $(rpm -qa); do rpm --setperms $p; done


Enjoy..!!

Take RDP of your ubuntu from windows machine – Ubuntu 14.04

To take the Remote desktop of your ubuntu machine from windows machine using ‘mstsc’, we have an option to do that by installing the xrdp remote desktop protocol.

With the release of Ubuntu 14.04, the xRDP functionality has been improved but some small issues are still showing up. In this post, we will show you how to

• Easily install xRDP
• Connect to your Ubuntu Unity Desktop Interface
• Set the keyboard layout to be used when using xRDP

Let’s go !

~]$ sudo apt-get install ubuntu-desktop



 install xrdp using below command

~$ sudo apt-get install xrdp

add the user to access the ubuntu using the same user account

~]$sudo adduser arkit

 

Note: adding the user will not have a administrator access, in order to provide administrator access to created user account provide sudo access

~]$sudo adduser arkit sudo

start the xrdp service

~]$sudo /etc/init.d/xrdp start

now try to access from your windows machine
Start >> Run >> mstsc


type the IP address and click on connect

provide the user name and password which you have created
Note: if your getting an below error

then do the below steps to resolve the issue

aravi@ankam-ubuntu:~$ sudo apt-get install gnome-session-fallback

aravi@ankam-ubuntu:~$ echo "gnome-session --session=gnome-fallback" > ~/.xsession aravi@ankam-ubuntu:~$ cat .xsession gnome-session --session=gnome-fallback

restart the xrdp service

~]$sudo /etc/init.d/xrdp restart

Still no Luck..!!

then try below

~]$ps -ef |grep vnc

~]$kill -9 <PID>

Now try you will get it..

Screen recording (video capturing) in RHEL7 using Krut

About Kurt

Krut has an intuitive and compact interface and boasts the following features

• Timer-controlled recording
• Movable recording areas during recording
• Preview of ongoing recording
• Optional mouse pointer recording
• Record/Playback at 2 different frame rates
• Highly accurate audio-video synchronization

As it is written in Java and is available as a runnable jar file, it is very easy to use on your Centos 7/RHEL7

Prerequisites to run Krut

Krut is required run java you have install java, jar and jdk.
GUI desktop have to be installed since it is a graphical user mode

Installation Procedure

 

~]#yum install java*

click on this link to Download Kurt

~]#unzip krut_full_0_9_4.zip

~]#cd Krut

~]#java -jar krut.jar

Krut recording screen

click on record button to record the screen


click on the Menu -> Settings

You can change the settings whatever you want.

Enjoy..!!

Please provide your valuable comments….

 

Convert time Seconds to Hours-Minutes-Seconds format - Shell Scripting

Using below script you can convert the seconds to Hours-Minutes-Seconds.

Writing loop _hms then converting the hours / 3600 because for hour 3600 seconds. Minutes can be converted using 3600/60 because it's equal to Minute.

#!/bin/bash
##Author: Ankam Ravi Kumar
##Date: 14th, SEP, 2015
##Convert seconds to Hours:Minutes:Seconds Format using this Script
##  START ##

[ -z ${1} ] && echo "Usage: $(basename $0) <seconds>" && exit||secs=${1}
_hms()
{
 local S=${1}
 ((h=S/3600))
 ((m=S%3600/60))
 ((s=S%60))
 printf "%dh:%dm:%ds\n" $h $m $s
}

_hms ${secs}
## END ##

Execution steps:
~]$ ./seconds.sh
Usage: convert.sh <seconds>

~]$ ./seconds.sh 456
1h:0m:0s

The same script also can be write as one line base line like below

$ secs=3600
$ printf ""%dh:%dm:%ds"\n" $(($secs/3600)) $(($secs%3600/60)) $(($secs%60))
1h:0m:0s

Same conversion we can write using awk as below

$ echo - | awk -v "S=3600" '{printf "%dh:%dm:%ds",S/(60*60),S%(60*60)/60,S%60}'
1h:0m:0s 

Video Tutorial

 

Print beautiful text banners - RHEL7 for freshers

To Print Text Banners in beautiful using a simple command.

This 'figlet' command required to install the figlet fonts to install the print follow the below process. 


Login to your Linux Server then run below command
~]# wget ftp://ftp.figlet.org/pub/figlet/program/unix/figlet-2.2.3.tar.gz



it will download an figlet package and save in current directory

Extra your figlet tar file using tar command
~]# tar -xzvf figlet-2.2.3.tar.gz

Now run to install the figlet
~]# make figlet 


Now copy the .flf files to /usr/local/bin/ directory
~]#cd figlet-2.2.3
~]# cp * /usr/local/bin/
~]#figlet -k ravi

Please provide your valuable comments........