Working with the Audit Log

You have been asked to develop an improved audit policy to monitor user creation as well as sudo privilege. You must configure Auditd to watch for writes to /etc/passwd and audit them using the userwatch key. You need to audit any reads or writes to /etc/sudoers using the sudowatch key. You also need to watch for executions of /sbin/visudo using the sudowatch key as well.

Once the audit rules are active, write the live rule set to /home/cloud_user/rules.txt using the auditctl command. Then you will need to test them by creating a user and running the visudo command. You will need to generate a report for both the userwatch and the sudowatch audit keys using the ausearch command. The userwatch key output should be written to /home/cloud_user/userwatch.txt and the sudowatch key output should be written to /home/cloud_usre/sudowatch.txt.

Summary tasks list:

• Create audit rules to watch /etc/passwd, /etc/sudoers/, and /sbin/visudo for appropriate properties.

• Generate an audit rule list in /home/cloud_user/rules.txt.

• Generate logs by creating a new user and running the visudo command.

• Generate the userwatch.txt and sudowatch.txt reports in /home/cloud_user by using the established audit keys userwatch and sudowatch, respectively.