Server security / Stage 9 of 10

Who changed the file: auditd

Not running Starting usually ~20 s

Step 6 of 6 · summary · 3 min

Summary

File permissions and a service's log do not say who wrote to a file — auditd records that by a rule.
A rule is set with auditctl -w <path> -p wa -k <key>, events are read with ausearch -k <key> -i.
In an event comm/exe are the program, uid is the effective user, auid is who logged in (unset for a boot-time service), and ppid leads to the service.
A persistent rule is a line in /etc/audit/rules.d/*.rules, loaded by augenrules --load; it survives an auditd restart.
The line in /etc/hosts from the start of the lesson was appended by a service: the audit event named the sed program and its path, and ppid led to the unit that ran it.

Ubuntu 24.04