7.3. Configuring the audit Service
The Audit daemon can be configured in the
/etc/audit/auditd.confconfiguration file. This file consists of configuration parameters that modify the behavior of the Audit daemon. Any empty lines or any text following a hash sign (
#) is ignored. See the auditd.conf(5) man page for a complete listing of all configuration parameters and their explanation.
auditd for a CAPP Environment
auditdconfiguration should be suitable for most environments. However, if your environment has to meet the criteria set by the Controlled Access Protection Profile (CAPP), which is a part of the Common Criteria certification, the Audit daemon must be configured with the following settings:
- The directory that holds the Audit log files (usually
/var/log/audit/) should reside on a separate partition. This prevents other processes from consuming space in this directory, and provides accurate detection of the remaining space for the Audit daemon.
max_log_fileparameter, which specifies the maximum size of a single Audit log file, must be set to make full use of the available space on the partition that holds the Audit log files.
max_log_file_actionparameter, which decides what action is taken once the limit set in
max_log_fileis reached, should be set to
keep_logsto prevent Audit log files from being overwritten.
space_leftparameter, which specifies the amount of free space left on the disk for which an action that is set in the
space_left_actionparameter is triggered, must be set to a number that gives the administrator enough time to respond and free up disk space. The
space_leftvalue depends on the rate at which the Audit log files are generated.
- It is recommended to set the
execwith an appropriate notification method.
admin_space_leftparameter, which specifies the absolute minimum amount of free space for which an action that is set in the
admin_space_left_actionparameter is triggered, must be set to a value that leaves enough space to log actions performed by the administrator.
admin_space_left_actionparameter must be set to
singleto put the system into single-user mode and allow the administrator to free up some disk space.
disk_full_actionparameter, which specifies an action that is triggered when no free space is available on the partition that holds the Audit log files, must be set to
single. This ensures that the system is either shut down or operating in single-user mode when Audit can no longer log events.
disk_error_action, which specifies an action that is triggered in case an error is detected on the partition that holds the Audit log files, must be set to
halt, depending on your local security policies regarding the handling of hardware malfunctions.
flushconfiguration parameter must be set to
data. These parameters assure that all Audit event data is fully synchronized with the log files on the disk.
The remaining configuration options should be set according to your local security policy.