To make sure that your system is not made to do undesired things, track any attempts to change the cron and at configurations or the lists of scheduled jobs. Tracking any write access to the user, group, password and login databases and logs helps you identify any attempts to manipulate your system's user database.
Tracking changes to your system configuration (kernel, services, time, etc.) helps you spot any attempts of others to manipulate essential functionality of your system. Changes to the PAM configuration should also be monitored in a secure environment, because changes in the authentication stack should not be made by anyone other than the administrator, and it should be logged which applications are using PAM and how it is used. The same applies to any other configuration files related to secure authentication and communication.
-w /var/spool/atspool -w /etc/at.allow -w /etc/at.deny -w /etc/cron.allow -p wa -w /etc/cron.deny -p wa -w /etc/cron.d/ -p wa -w /etc/cron.daily/ -p wa -w /etc/cron.hourly/ -p wa -w /etc/cron.monthly/ -p wa -w /etc/cron.weekly/ -p wa -w /etc/crontab -p wa -w /var/spool/cron/root
-w /etc/group -p wa -w /etc/passwd -p wa -w /etc/shadow -w /etc/login.defs -p wa -w /etc/securetty -w /var/log/faillog -w /var/log/lastlog
-w /etc/hosts -p wa -w /etc/sysconfig/ -w /etc/inittab -p wa -w /etc/init.d/ -w /etc/init.d/auditd -p wa -w /etc/ld.so.conf -p wa -w /etc/localtime -p wa -w /etc/sysctl.conf -p wa -w /etc/modprobe.d/ -w /etc/modprobe.conf.local -p wa -w /etc/modprobe.conf -p wa
-w /etc/pam.d/
-w /etc/aliases -p wa -w /etc/postfix/ -p wa
-w /etc/ssh/sshd_config -w /etc/stunnel/stunnel.conf -w /etc/stunnel/stunnel.pem -w /etc/vsftpd.ftpusers -w /etc/vsftpd.conf
-a exit,always -S sethostname -w /etc/issue -p wa -w /etc/issue.net -p wa
Set watches on the at and cron configuration and the scheduled jobs and assign labels to these events. | |
Set watches on the user, group, password, and login databases and logs and set labels to better identify any login-related events, such as failed login attempts. | |
Set a watch and a label on the static hostname configuration in
| |
Set watches on the PAM configuration directory. If you are interested in particular files below the directory level, add explicit watches to these files as well. | |
Set watches to the postfix configuration to log any write attempt or attribute change and use labels for better tracking in the logs. | |
Set watches and labels on the ssh, stunnel, and vsftpd configuration files. | |
Perform an audit of the sethostname system call and
set watches and labels on the system identification configuration in
|