再探 audit 审计机制

1. 定期执行意味着短时间运行的进程或文件可能监控不到;

2. 开启 socket 监控, 可能产生很多日志, 尤其在短连接很多的场景中;

3. auditbeat 提供了内存队列, 磁盘限额存储事件等特性, 防止事件太多造成不可控的影响;

ICMP, DHCP, DNS, HTTP
AMQP, Cassandra, MySQL, PostgreSQL, Redis, MongoDB, Memcached
NFS, TLS, Thrift

processors:
  - add_host_metadata: ~
  - drop_event:
      when:
        or:
          - network:
              source.ip: private
          - network:
              destination.ip: '192.168.1.0/24'

syslog, audit, secure, haproxy, iis, tomcat, nginx, kafka, zeek
mysql, postgresql, mssql, oracle, mongodb, redis, elasticsearch ...

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/telegraf/telegraf*.log
  fields:
    logmon: telegraf

- type: log
  enable: true
  paths:
    - /var/log/filebeat/filebeat*
  fields:
    logmon: filebeat

- type: log
  enable: true
  paths:
    - /data/scripts/logs/*.log
  fields:
    logmon: scripts

filebeat.config.modules:
  reload.enabled: true
  reload.period: 15s
  path: /etc/filebeat/modules.d/*.yml

mysql, redis, system

-a never,exit   # 系统调用 exit 的时候永不记录
-a always,exit  # 总在系统调用 exit 的时候记录

# 仅测试环境
-a always,exit -F arch=b64 -S open -S sendfile -S truncate -S ftruncate -S chdir -S fchdir -S rename -S mkdir -S rmdir -S creat -S unlink -S readlink -S openat -S mkdirat -S unlinkat -S renameat -S readlinkat -F key=note

-a always,exit -F arch=b64 -S mount,umount2 -F auid!=-1 -F key=mount
-a always,exit -F arch=b32 -S mount,umount,umount2 -F auid!=-1 -F key=mount

-w /etc/sysconfig/iptables -p wa -k iptables

-w /etc/sysctl.conf -p wa -k sysctl
-w /etc/sysctl.d -p wa -k sysctl

-w /sbin/auditctl -p x -k audittools
-w /sbin/auditd -p x -k audittools
-w /usr/sbin/auditd -p x -k audittools
-w /usr/sbin/augenrules -p x -k audittools

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p rwxa -k identity
-w /etc/shadow -p rwxa -k identity

-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d -p wa -k actions
-w /usr/bin/passwd -p x -k passwd_modification
-w /usr/sbin/groupadd -p x -k group_modification
-w /usr/sbin/groupmod -p x -k group_modification
-w /usr/sbin/addgroup -p x -k group_modification
-w /usr/sbin/useradd -p x -k user_modification
-w /usr/sbin/userdel -p x -k user_modification
-w /usr/sbin/usermod -p x -k user_modification
-w /usr/sbin/adduser -p x -k user_modification
-w /etc/ssh/sshd_config -p rwxa -k sshd
-w /etc/ssh/sshd_config.d -p rwxa -k sshd

# 常见命令打标签, 方便监控
-w /usr/sbin/iptables -p x -k note_cmd
-w /usr/bin/zip -p x -k note_cmd
-w /usr/bin/gzip -p x -k note_cmd
-w /usr/bin/bzip2 -p x -k note_cmd
-w /usr/bin/lz4 -p x -k note_cmd
-w /usr/bin/zstd -p x -k note_cmd
-w /usr/bin/tar -p x -k note_cmd
-w /usr/bin/cp -p x -k note_cmd
-w /usr/bin/mv -p x -k note_cmd
-w /usr/bin/wget -p x -k note_cmd
-w /usr/bin/curl -p x -k note_cmd
-w /usr/bin/scp -p x -k note_cmd
-w /usr/bin/rsync -p x -k note_cmd
-w /usr/bin/ftp -p x -k note_cmd
-w /usr/bin/sftp -p x -k note_cmd
-w /usr/bin/hexdump -p x -k note_cmd
-w /usr/bin/xxd -p x -k note_cmd
-w /usr/bin/ln -p x -k note_cmd

-a always,exit -F arch=b64 -S truncate,ftruncate,creat -F exit=-EACCES -F key=access
-a always,exit -F arch=b64 -S truncate,ftruncate,creat -F exit=-EPERM -F key=access

-a always,exit -F arch=b64 -S bind -S execve -S connect
-a always,exit -F arch=b32 -S bind -S execve -S connect

- module: file_integrity
  paths:
  - /bin
  - /usr/bin
  - /sbin
  - /usr/sbin
  - /etc

  max_file_size: 3000 MiB

- module: system
  datasets:
    - login
    - process
    - user

  state.period: 8h
  process.hash.max_file_size: 1000 MiB

  user.detect_password_changes: true
  login.wtmp_file_pattern: /var/log/wtmp*
  login.btmp_file_pattern: /var/log/btmp*

tags: ["xxxxx"]         # 标识信息

fields:
  logmon: auditbeat     # 自定义字段, 方便 logstash 等工具判断处理

没有 uid 的行为;
忽略 telegraf/zabbix 等监控行为相关的事件;
忽略 crond 相关的事件;
忽略 mysql, redis-cli 等相关的正常事件;

  - drop_event:
      when:
        or:
          - equals: # old-uid is not set(-1)
              auditd.summary.actor.primary: "unset"
          - contains:
              process.title: "iptables -S"
          - contains:
              process.args: "-tnlp"
          - equals:
              process.name: "redis-cli"
          - equals:
              process.executable: "mysql"
          - equals:
              process.executable: "mongo"
          - equals:
              user.saved.name: "telegraf"
          - equals:
              user.name: "telegraf"

+-----------------+
|     Host A      |
|  +-----------+  |
|  | telegraf  |  |           +--------------------+                              +-----------------+
|  +-----------+  |           |   victoriaMetrics  |----------------------------> |  metric monitor |
|  | filebeat  |--+------->   +--------------------+        +---------------+     +-----------------+
|  +-----------+  |           |  logstash / kafak  |------> | elasticsearch |---> |  audit  monitor |
|  | auditbeat |  |           +--------------------+        +---------------+     |  log    monitor |
|  +-----------+  |                                                               +-----------------+
|                 |
+-----------------+