Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases now! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Red Hat Enterprise Linux Server Cookbook

You're reading from   Red Hat Enterprise Linux Server Cookbook Over 60 recipes to help you build, configure, and orchestrate RHEL 7 Server to make your everyday administration experience seamless

Arrow left icon
Product type Paperback
Published in Dec 2015
Publisher
ISBN-13 9781784392017
Length 250 pages
Edition 1st Edition
Tools
Concepts
Arrow right icon
Authors (2):
Arrow left icon
Jakub Gaj Jakub Gaj
Author Profile Icon Jakub Gaj
Jakub Gaj
William Leemans William Leemans
Author Profile Icon William Leemans
William Leemans
Arrow right icon
View More author details
Toc

Table of Contents (12) Chapters Close

Preface 1. Working with KVM Guests FREE CHAPTER 2. Deploying RHEL "En Masse" 3. Configuring Your Network 4. Configuring Your New System 5. Using SELinux 6. Orchestrating with Ansible 7. Puppet Configuration Management 8. Yum and Repositories 9. Securing RHEL 7 10. Monitoring and Performance Tuning Index

Auditing the system

The Linux audit system allows you to track security-related information about your systems. It allows you to watch security events, filesystem access, network access, commands run by users, and system calls.

How to do it…

By default, audit is installed as part of the core packages. So, there's no need to install this.

Configuring a centralized syslog server to accept audit logs

Perform these steps to set up the syslog server:

  1. On the syslog server, create a /etc/rsyslog.d/audit_server.conf file containing the following:
    # Receive syslog audit messages via TCP over port 65514
    $ModLoad imtcp
    $InputTCPServerRun 65514
    $AllowedSender TCP, 127.0.0.1, 192.168.1.0/24
    $template HostAudit, "/var/log/audit/%$YEAR%%$MONTH%%$DAY%-%HOSTNAME%/audit.log"
    $template auditFormat, "%msg%\n" local6.*  ?HostAudit;auditFormat
  2. On the syslog server, restart rsyslog, as follows:
    ~]# systemctl restart rsyslog
    
  3. On the client, create a /etc/rsyslog.d/audit_client.conf file...
lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime