Setting Up Audit Rules - Novell LINUX ENTERPRISE SERVER 11 - SECURITY Manual

As you need system call auditing capabilities even when you are configuring plain file
or directory watches, you need to enable audit contexts for system calls. To enable audit
contexts for the duration of the current session only, execute auditctl -e 1 as
root. To disable this feature, execute auditctl -e 0 as root.
To enable audit contexts for system calls permanently, open the /etc/sysconfig/
auditd configuration file as root and set AUDITD_DISABLE_CONTEXTS to no.
Then restart the audit daemon with the rcauditd restart command. To turn this
feature off temporarily, use auditctl -e 0. To turn it off permanently, set
AUDITD_DISABLE_CONTEXTS to yes.

31.4 Setting Up Audit Rules

Using audit rules, determine which aspects of the system should be analyzed by audit.
Normally this includes important databases and security-relevant configuration files.
You may also analyze various system calls in detail if a broad analysis of your system
is required. A very detailed example configuration that includes most of the rules that
are needed in a CAPP compliant environment is available in Chapter 32, Introducing
an Audit Rule Set (page 423).
Audit rules can be passed to the audit daemon on the auditctl command line as well
as by composing a rule set in /etc/audit/audit.rules which is processed
whenever the audit daemon is started. To customize /etc/audit/audit.rules
either edit it directly, or use YaST: Security and Users > Linux Audit Framework (LAF)
> Rules for 'auditctl'. Rules passed on the commandline are not persistent and have to
be re-entered when the audit daemon is restarted.
A simple rule set for very basic auditing on a few important files and directories could
look like this:
# basic audit system parameters
-D
-b 8192
-f 1
-e 1
# some file and directory watches with keys
-w /var/log/audit/ -k LOG_audit
-w /etc/audit/auditd.conf -k CFG_audit_conf -p rxwa
-w /etc/audit.rules -k CFG_audit_rules -p rxwa
Setting Up the Linux Audit Framework 415