![细节](https://linux22.com/image/92642/%E7%BB%86%E8%8A%82.png)
我正在尝试配置在 VirtualBox 中运行的 CentOS 7,以将其审核日志发送到 FreeBSD 10.3 主机。理想情况下,我希望接收 FreeBSD 的日志auditdistd(8)
但现在我只想能够使用 netcat 来实现这一点。
我的问题是 netcat 没有获取任何数据。
细节
- 当我运行时,
service auditd status
我得到以下结果:
Redirecting to /bin/systemctl status auditd.service auditd.service - Security Auditing Service Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled) Active: active (running) since Fri 2016-08-19 11:35:42 CEST; 3s ago Process: 2216 ExecStartPost=/sbin/augenrules --load (code=exited, status=1/FAILURE) Main PID: 2215 (auditd) CGroup: /system.slice/auditd.service ├─2215 /sbin/auditd -n └─2218 /sbin/audispd Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedly Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote has exceeded max_restarts Aug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restarted
设置
网络设置
- CentOS 和 FreeBSD 在仅主机网络上连接。我已经为他们分配了以下 IP:
- CentOS:192.168.56.101
- 自由BSD:192.168.56.1
FreeBSD 安装
我已经让 netcat 监听端口 60:
nc -lk 60
连接有效。我可以nc 192.168.56.1 60
在 CentOS 上使用向 FreeBSD 发送数据。
CentOS设置
内核版本是:
4.7.0-1.el7.elrepo.x86_64 #1 SMP Sun Jul 24 18:15:29 EDT 2016 x86_64 x86_64 x86_64 GNU/Linux
.Linux Audit 用户空间的版本是2.6.6。
auditd 正在运行并主动记录到
/var/log/audit.log
.中的审核规则
/etc/audit/rules.d/
配置良好。的配置
/etc/audisp/audisp-remote.conf
如下所示:remote-server = 192.168.56.1 port = 60 local_port = any transport = tcp mode = immediate
/etc/audisp/plugins.d/
我在:syslog.conf
和中有两个默认文件,af_unix.conf
并且它们都不是活动的。我已经添加了af-remote.conf
,它看起来像这样:# This file controls the audispd data path to the # remote event logger. This plugin will send events to # a remote machine (Central Logger). active = yes direction = out path = /sbin/audisp-remote type = always #args = format = string
这是一个修改后的例子官方存储库(链接)。
以下是 的内容
/etc/audisp/audispd.conf
:q_depth = 150 overflow_action = SYSLOG priority_boost = 4 max_restarts = 10 name_format = HOSTNAME
如果需要,我很乐意提供更多详细信息。
答案1
我不确定这里的一切是否都是成功所必需的。尽管如此,这个配置还是有效的,因此我能够在 FreeBSD 上使用 netcat 接收 Linux 审核日志。
CentOS
/etc/audisp/audisp-remote.conf
::remote_server = 192.168.56.1 port = 60 local_port = 60 transport = tcp mode = immediate queue_depth = 200 format = managed
CentOS
/etc/audisp/plugins.d/au-remote.conf
::active = yes direction = out path = /sbin/audisp-remote type = always args = /etc/audisp/audisp-remote.conf format = string
CentOS
/etc/audit/auditd.conf
::local_events = yes log_file = /var/log/audit/audit.log # Send logs to the server. Don't save them. write_logs = no log_format = RAW log_group = root priority_boost = 8 num_logs = 5 disp_qos = lossy dispatcher = /sbin/audispd name_format = hostname max_log_file = 6 max_log_file_action = ROTATE action_mail_acct = root space_left = 75 space_left_action = SYSLOG admin_space_left = 50 admin_space_left_action = SUSPEND disk_full_action = SUSPEND disk_error_action = SUSPEND ##tcp_listen_port = tcp_listen_queue = 5 tcp_max_per_addr = 1 use_libwrap = yes ##tcp_client_ports = 1024-65535 tcp_client_max_idle = 0 enable_krb5 = no krb5_principal = auditd ##krb5_key_file = /etc/audit/audit.key distribute_network = no
自由BSD
/etc/hosts.allow
::ALL : ALL : allow
我不知道是否需要这个+这可能是一个坏主意。
就是这样。现在您只需nc -lk 60
在 FreeBSD 和service auditd restart
CentOS 上运行即可。然而,就我而言,netcat 似乎至少接收/打印每条记录两次,这似乎相当不寻常。