Problem Statement
Outline a practical Linux auditd policy for critical servers.
Explanation
Monitor identity and integrity first. Watch auth files and user/privilege changes (for example passwd, shadow, sudoers). Track use of privileged binaries and kernel settings, and record changes under /etc. Capture execve of high-risk tools like bash, netcat, ssh, and package managers. Include network connection attempts from privileged processes. Send logs off-host to a central collector and set immutable audit rules for critical systems so attackers cannot disable auditing without notice. Tune to reduce noise while preserving high-value events to keep analysts focused.
Code Solution
SolutionRead Only
Example rules: auditctl -w /etc/sudoers -p wa -k sudo auditctl -a always,exit -F arch=b64 -S execve -k exec augenrules --load
