Overview
Security audit, vulnerability scanning, and compliance checking skills.
auditd Audit System
Installation and Management
# 安装
apt install auditd audispd-plugins # Debian/Ubuntu
yum install audit # CentOS/RHEL
# 服务管理
systemctl start auditd
systemctl enable auditd
systemctl status auditd
Audit Rules
# 查看规则
auditctl -l
# 添加规则 - 监控文件
auditctl -w /etc/passwd -p wa -k passwd_changes
auditctl -w /etc/shadow -p wa -k shadow_changes
auditctl -w /etc/sudoers -p wa -k sudoers_changes
# 监控目录
auditctl -w /etc/ssh/ -p wa -k ssh_config
# 监控系统调用
auditctl -a always,exit -F arch=b64 -S execve -k command_exec
# 监控用户操作
auditctl -a always,exit -F arch=b64 -S open -F auid>=1000 -k user_file_access
Permanent Rules
# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/sudoers -p wa -k sudoers_changes
-w /var/log/lastlog -p wa -k logins
-a always,exit -F arch=b64 -S execve -k commands
# 重载规则
augenrules --load
View Logs
# 搜索审计日志
ausearch -k passwd_changes
ausearch -k commands -ts today
ausearch -ua root -ts recent
# 生成报告
aureport
aureport --summary
aureport --login
aureport --file
aureport --executable
Log Audit
System Logs
# 查看认证日志
tail -f /var/log/auth.log # Debian/Ubuntu
tail -f /var/log/secure # CentOS/RHEL
# 查看登录记录
last
lastb # 失败登录
lastlog
# journalctl
journalctl -u sshd
journalctl --since "1 hour ago"
journalctl -p err
Log Analysis
# 统计 SSH 登录失败
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn
# 统计 sudo 使用
grep "sudo:" /var/log/auth.log | tail -20
# 查找异常登录
grep "Accepted" /var/log/auth.log | grep -v "192.168"
Vulnerability Scanning
Lynis
# 安装
apt install lynis
# 系统审计
lynis audit system
# 查看报告
cat /var/log/lynis-report.dat
OpenSCAP
# 安装
yum install openscap-scanner scap-security-guide
# 扫描
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard \
--results results.xml \
/usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml
# 生成报告
oscap xccdf generate report results.xml > report.html
Nmap Scanning
# 端口扫描
nmap -sV -sC target.com
# 漏洞扫描
nmap --script vuln target.com
# 全面扫描
nmap -A -T4 target.com
File Integrity
AIDE
# 安装
apt install aide
# 初始化数据库
aide --init
mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
# 检查变更
aide --check
# 更新数据库
aide --update
Tripwire
# 初始化
tripwire --init
# 检查
tripwire --check
# 更新策略
tripwire --update-policy
Common Scenarios
Scenario 1: Monitoring Privileged Operations
# /etc/audit/rules.d/privileged.rules
# 监控 sudo
-w /usr/bin/sudo -p x -k privileged_sudo
-w /etc/sudoers -p wa -k sudoers_edit
# 监控用户管理
-w /usr/sbin/useradd -p x -k user_add
-w /usr/sbin/userdel -p x -k user_del
-w /usr/sbin/usermod -p x -k user_mod
# 监控网络配置
-w /etc/hosts -p wa -k hosts_edit
-w /etc/network/ -p wa -k network_config
Scenario 2: Compliance Check Script
#!/bin/bash
echo "=== 安全合规检查 ==="
# 检查空密码账户
echo "空密码账户:"
awk -F: '($2 == "") {print $1}' /etc/shadow
# 检查 UID 为 0 的账户
echo "UID=0 账户:"
awk -F: '($3 == 0) {print $1}' /etc/passwd
# 检查 SSH 配置
echo "SSH 配置:"
grep -E "^(PermitRootLogin|PasswordAuthentication)" /etc/ssh/sshd_config
# 检查开放端口
echo "监听端口:"
ss -tlnp
Scenario 3: Login Alerts
#!/bin/bash
# /etc/profile.d/login-alert.sh
if [ -n "$SSH_CLIENT" ]; then
IP=$(echo $SSH_CLIENT | awk '{print $1}')
echo "SSH 登录告警: 用户 $USER 从 $IP 登录 $(hostname)" | \
mail -s "SSH Login Alert" admin@example.com
fi
Troubleshooting
| Issue | Troubleshooting Method |
|---|---|
| Audit logs too large | Configure log rotation and filter rules |
| Performance impact | Reduce audit rules and optimize filtering |
| Rules not taking effect | Check syntax and reload rules |
# 检查 auditd 状态
auditctl -s
# 查看丢失事件
aureport --summary | grep lost
# 日志轮转配置
# /etc/audit/auditd.conf
max_log_file = 50
num_logs = 5
max_log_file_action = ROTATE