AIX AUDIT: The Audit Subsystem in AIX

The auditing subsystem provides the means to record security-related information and to alert system administrators of potential and actual violations of the system security policy. The information collected by auditing includes: the name of the auditable event, the status (success or failure) of the event, and any additional event-specific information related to security auditing.

A list of audit events built into AIX, along with a list of predefined audit objects, can be found in the file /etc/security/audit/events.

In general, auditing events are defined at the system call level. A single operation at the command line would result in records of several events in the audit trail. For example, when viewing a file using the cat or more command, you would see the following records logged into the audit trail:

FILE_Open (file is opened)
FILE_Read (file is read)
FILE_Write (file is written to standard output)
PROC_Create (process creation for more OR cat)
PROC_Execute (command execution)
PROC_Delete (process completion)

Auditing all possible events can produce a huge amount of data. Through audit controls (that is, modifying the configuration files), you can select events to be recorded.

Audit events are grouped into classes. The events can be defined by which events are in a class. While the class names are arbitrary, they, rather than individual event names, are associated with user IDs when the audit subsystem is active.

Auditing objects are just individual files that will be monitored. Three operations can be audited: read, write, and execute. Objects are not associated with user IDs. Audit records are generated whenever an audited object is referenced by any user (including root).

To add further audit objects, extend the /etc/security/audit/objects file.

There are two modes of operation for auditing: BIN and STREAM. BIN mode writes the audit trail to alternating temporary files (bins), then to a single trail file. STREAM mode writes to a circular buffer that is read synchronously through an audit pseudo-device (/dev/audit).

An audit can be started in one OR both of these modes.

The /etc/security/audit/config file is the audit configuration file shipped in AIX.  By default, the BIN mode alternates between /audit/bin1 and /audit/bin2. When one BIN is full (the binsize parameter determines the size of the bin), audit switches to the other BIN file, while adding the accumulated data in the first file to the audit trail file defined in /etc/security/audit/config. The default file is /audit/trail. Use audit shutdown to be certain that all audit records have been added to /audit/trail. The BIN mode audit record is in binary format. You can read it with audit commands such as auditpr.

In STREAM mode, the default AIX configuration provides a program to read the STREAM buffer and processes each record with the commands found in /etc/security/audit/streamcmds. These commands format the output into human-readable form and write it in /audit/stream.out. This file is NOT cumulative; it is restarted every time the audit is restarted. The STREAM audit trail can be read in real time by reading /audit/stream.out, or by sending output directly to a terminal or printer.

There are five audit subcommands for invoking auditing. 

• audit start
  • Activate the audit subsystem (This is the only correct way to start audit.)
• audit shutdown
  • Stop auditing subsystem, processing final BIN records and removing the /audit/auditb file that is used as an "active" indicator by the audit modules
• audit off
  • Suspend auditing temporarily
• audit on
  • Resume audit after audit off
• audit query
  • Display the status of auditing

NOTE: Using audit commands in the wrong order can confuse the auditing subsystem. If the auditing subsystem gets confused, reset everything by deleting all files in the /audit directory (except trail, stream.out and bin files).

Auditing is run at the discretion of the system administrator. We recommend preparing in advance a list of critical objects (files) or events to be audited, before a critical situation actually arises. Thus, you can avoid unnecessary load, unless you start the audit subsystem.

• It may not be necessary to have auditing running at all times. 
• Collecting and handling a large number of events and objects might add extra load to the system

To start auditing at system startup using BIN Mode, add the audit command to the /etc/rc file, above the "Multi-user initialization completed" line.

If audit is enabled to run at all times, add the audit shutdown command to /etc/rc.shutdown , which is called by /usr/sbin/shutdown.

• Changes made directly to /usr/sbin/shutdown are overwritten during AIX updates.

All auditing related configuration files reside in /etc/security/audit. The /etc/security/audit/config file contains the key audit controls. It has the following stanzas:

• start
  • Specifies whether BIN or STREAM (or both) should be used for auditing.
• bin and stream
  • Contains controls for each mode; the names of the BIN files are specified here.
• classes
  • Defines several groups (classes) of auditing events.
    • The predefined classes are: general, objects, SRC, kernel, files, SVIPC, mail, cron, and TCP/IP.
    • New classes can be defined using the auditing events in the /etc/security/audit/events file.
    • All audit classes, except the objects class, are associated with user IDs. 
• user stanza
  • Lists specified users and the audit classes assigned to them.
    • Each user name must be the login name of a system user, or the string 'default'.

For example,

When auditing starts, it ALWAYS audits the events specified for every user ID defined in the config file and ALL the objects defined in /etc/security/audit/objects. If the objects' audit records are not wanted, remove or comment out (using an *) the objects defined in the objects file.

If there are specific classes of events that are not wanted as audit records, specify No_Events for that specific class in the config file.

For example:

    files = No_Events
          or
    tcpip = No_Events

The objects file contains all objects to be audited when auditing is active. A user defined object is displayed as:

    /home/joe/my.stuff:
                        r = "JOE_READ"
                        w = "JOE_WRITE"

The names JOE_READ and JOE_WRITE are referenced in the /etc/security/audit/events file to define the format of the auditpr output:

    JOE_READ = printf "%s"
    JOE_WRITE = printf "%s"

NOTE: There is no need to add the newly added objects to the objects stanza in the /etc/security/audit/config file, since the objects line is not referenced. Only the objects file is referenced.

The streamcmds file has commands that are entered for STREAM audit records. The default file contains one command.

Enter:

    /usr/sbin/auditstream | auditpr > /audit/stream.out &

Adding the -v flag for the auditpr command improves this command at the expense of having more information. Without -v, full path names for files are not shown in the audit output; only file descriptors are recorded.

To limit the amount of data collected during the auditing operation, use the -c option on the auditstream command to select a specific class of events as defined in the config file, or use the auditselect command to select specific events.

For example:

NOTE: This command must be all on one line in the streamcmds file. This command will collect only FILE_Open event records.

 /usr/sbin/auditstream | /usr/sbin/auditselect -e "event == FILE_Open"
 | auditpr -v > /audit/stream.out &

NOTE: The following command will limit data collection to only the TCP/IP class of events as defined in the config file.

    /usr/sbin/auditstream -c tcpip | auditpr -v > /audit/stream.out &

The bincmds file contains commands that are entered whenever a BIN file fills or when auditing is shut down. The file distributed reads like the following:

    /usr/sbin/auditcat -p -o $trail $bin

The environment variables in the preceding command are defined while auditing is active. The auditselect command can be added to select specific events, reducing the amount of audit records.

The bincmds file will only collect audit records that match USER_SU or USER_Login audit events. Enter:

    /usr/sbin/auditselect -e "event== USER_SU || event== \
      USER_Login" $bin > /audit/trail.login

For example:

1. To audit classes, use the fastpath command smit chuser.

   *User NAME              [joe]
   AUDIT classes           [general, files]
   

   A user stanza should be displayed for joe in /etc/security/audit/config file.

2. At the command line, edit the /etc/security/audit/config file. In the classes stanza, add the following new class:

       procmon = PROC_Create, PROC_Delete, PROC_Execute
   

   In the users stanza, the following could exist:

       joe = procmon
   

   The newly assigned audit classes will take effect at the next login for user joe.

3. The BIN mode audit trail can be read with the following:

       auditpr -v < /audit/trail | more
   

The STREAM mode audit file /audit/stream.out can be viewed directly. Remember that the /audit/stream.out file is rewritten each time the auditing subsystem is started. Save the old stream.out before starting auditing.

If you do not want the objects audit records when auditing a user ID, comment out the objects defined in the /etc/security/audit/objects file or rename this file.

In the following example, all processes writing to the /etc/utmp file will be audited.

1. Edit the /etc/security/audit/objects file to add the following:

   /etc/utmp:
   w = "UTMP_WRITE"
   

2. Edit the /etc/security/audit/events file to include the following:

   * /etc/utmp
   UTMP_WRITE = printf " %s "
   

   The audit record is displayed as follows:

   UTMP_WRITE      root    OK      Wed Jul 12 12:12:25 1995  init
   

In this case, the init process owned by root wrote to the file.

NOTE: The length of an audit event or object name cannot exceed 15 characters. This limit is defined in the header file /usr/include/sys/audit.h, ah_event [16]. The following error message usually indicates an invalid event or object name.

     "auditevents (): Invalid argument"

Each record in the audit trail takes about 50 to 150 bytes depending on what mode is used and whether the verbose mode flag is specified. This means that 1MB of data could contain about 6800 entries.

It is important to specify what information should be reviewed while auditing. Although you can configure auditing to record events of interest, there may still be too much data to be useful when viewed all at once. The auditselect command can be used with auditpr to sort through volumes of information and pull out only that which is needed for a specific report. It can be used to pull all data from a specific time period, for a specific user, or for a specific event, or any combination of these three.

For example:

    /usr/sbin/auditselect -f /audit/pick \
    /audit/trail | /usr/sbin/auditpr -v

The /audit/pick file reads as follows:

    command == rlogin && \
    time >= 08:00:00 && time <= 17:00:00 && \
    data >= 04/01/96 && date <= 04/12/96

This command reports the use of the rlogin command within the specific time interval (8AM-5PM between April 1 and April 12).

The compressed trail data from the binmode auditing is not in the same format at AIX version 3.2 as it is in 4.1 or later. There is a utility to convert the data from a pre-AIX Version 4 format to the Version 4 format. It is a command called auditconv.

Errors when starting audit

• There are certain errors that appear when running audit start.

  Error message:

      ** failed setting kernel audit objects
  

  This occurs when there is a syntax error in the /etc/security/audit/objects file.

• Error message:

      auditbin: ** failed backend command
      /etc/auditcat -p -o /audit/trail -r /audit/bin1
  

  This error can be corrected by removing or renaming the BIN files. It is sometimes helpful to run audit shutdown again and then to retry audit start.

• Error in config file:

  It is necessary to have the user stanza in the /etc/security/audit/ configuration file or the following error will display when you start auditing:

      Unable to find the user stanza in /etc/security/audit/config
  

If it is not obvious that the user stanza is missing, verify that each of the classes are defined on a single continuous line.

Given the way that cron and the TCPIP code is written, each sets up its own set of audit events. These events will get written into the audit trail regardless of how the config files are set up. The workaround is to use auditselect to exclude these events when generating the audit report. TCPIP sessions, ftpd, rexecd, and telnetd all call auditproc() to set up process auditing using the class tcpip in/etc/security/audit/config. The same thing is done in the cron code (at, cron, and cronadm) for the cron class in /etc/security/audit/config. These events will be written into the audit trail. The best thing to do is to filter them using auditselect.

For example:

    auditselect -e"event!=AT_JobAdd && event!=AT_JobRemove && 
..."

This will exclude events AT_JobAdd and At_JobRemove and so on.

Or select on the command name:

    auditselect -e"command!=cron && command!=at && ..."

This excludes recording related to commands, at, cron, and so on.