auditd not capturing administrator actions

[cjnosal]

The bosh_audit stage adds a rule to record system administrator actions. The current configuration attempts to log actions that modify /var/log/sudo.log (https://github.com/cloudfoundry/bosh-linux-stemcell-builder/blob/master/stemcell_builder/stages/bosh_audit/shared_functions.bash#L65)

This rule is ineffective because /var/log/sudo.log does not exist.

sudoer actions are being captured, but commands entered in a root shell are not.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/164989826

The labels on this github issue will be updated when the story is started.

[jaresty]

@xtreme-conor-nosal is this causing any issues that you are aware of? I'm assuming that this is a suggestion to remove the line you called out here; please let me know if my interpretation is incorrect. Thanks!

[cjnosal]

This is a CIS Stemcell Hardening failure (non-repudiation of logs). The corresponding test (https://github.com/cloudfoundry/bosh-linux-stemcell-builder/blob/master/bosh-stemcell/spec/support/os_image_shared_examples.rb#L660) references CIS 8.1.16 Collect System Administrator Actions (sudolog).

The CIS remediation does call for the current configuration (-w /var/log/sudo.log -p wa -k actions), but also calls out a precondition on 9.5 Restrict Access to the su Command that isn't currently met in the stemcell:
"If the system has been properly configured to disable the use of
the su command and force all administrators to have to log in first and then use sudo to
execute privileged commands, then all administrator commands will be logged to
/var/log/sudo.log"

I believe the current sudoer configuration is logging to syslog directly, not /var/log/sudo.log, and access to su is not restricted.

Regarding CIS 8.1.16, 2 options are:

1. reconfigure to log to /var/log/sudo.log (following CIS's documented remediation)
2. verify sudo logs to syslog, remove the ineffective auditd rule, and document that CIS 8.1.16 is being met via an alternate remediation

Regarding CIS 9.5, 2 options are:

1. restrict su
2. if that's not feasible, consider remediation via additional audit rules to capture root actions, for example -a exit,always -F euid=0 -F auid>1000 -S execve -k actions to capture programs launched by a bosh_ssh user in a su shell

[yatzek]

How about something like this:

-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=-1 -F key=sudo_log
-a always,exit -F arch=b32 -S execve -F euid=0 -F auid>=1000 -F auid!=-1 -F key=sudo_log

It captures "root" activity of real users and you can inspect the audit log with:
sudo ausearch -k sudo_log -i

Very good article describing this problem:
https://sudoedit.com/log-sudo-with-auditd/

[ramonskie]

closing as fixed in #167