Linux Labs
Linux Labs
EN

Server security / Stage 9 of 10

Who changed the file: auditd

Not running Starting usually ~20 s
Leave the lesson

Step 1 of 6 · on a machine · 6 min

The file changes by itself

What you will learn

  • Set a watch on a file with auditctl -w … -p wa -k and find events by their key with ausearch -k.
  • Read from an event which process and which user reached the file (comm, exe, auid, uid).
  • Make an audit rule persistent in /etc/audit/rules.d so it survives an auditd restart.

On this machine a line that no one typed appears in /etc/hosts every few seconds. Who appends it is not visible from the file. Watch how it changes.

Exercise · look

Watch /etc/hosts change

Look at the last line of /etc/hosts, remove the updates.lab.test line, wait a few seconds and look at the end of the file again.

First, predict

You removed the updates.lab.test line from /etc/hosts. What will be at the end of the file a few seconds later?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in
Check yourself 1 question

The line in /etc/hosts comes back after you delete it, and who writes it is not visible. Why can't the file tell you?

  • Auditing records root's actions too — after a rule ausearch -k hosts shows even a root event. It is not about the user but about there being no rule yet.

  • No editor opened the file — the line appears on its own. A service appends it, and auditing will show that.

  • The permissions on /etc/hosts are ordinary (644 root): ls -l /etc/hosts. The file keeps no name of the writer, whatever the permissions.

The file stores only text, and access to it is not recorded until an audit rule is set.

Found an inaccuracy? Report an error in the lesson

Ubuntu 24.04
Loading…