securing oracle linux 9 article 26 configuring auditd rules

سیستم عامل و زیرساخت Hits: 8

In the previous part, Auditd Service and Log Retention was completed.

1. CIS Benchmark Requirements (Section 6.3.3)

This article covers the implementation of the following CIS Benchmark requirements. The duplicated numbering has been corrected.

  • 6.3.3.1 Ensure changes to system administration scope (sudoers) is collected (Automated)
  • 6.3.3.2 Ensure actions as another user are always logged (Automated)
  • 6.3.3.3 Ensure events that modify the sudo log file are collected (Automated)
  • 6.3.3.4 Ensure events that modify date and time information are collected (Automated)
  • 6.3.3.5 Ensure events that modify the system’s network environment are collected (Automated)
  • 6.3.3.6 Ensure use of privileged commands are collected (Automated)
  • 6.3.3.7 Ensure unsuccessful file access attempts are collected (Automated)
  • 6.3.3.8 Ensure events that modify user/group information are collected (Automated)
  • 6.3.3.9 Ensure discretionary access control permission modification events are collected (Automated)
  • 6.3.3.10 Ensure successful file system mounts are collected (Automated)
  • 6.3.3.11 Ensure session initiation information is collected (Automated)
  • 6.3.3.12 Ensure login and logout events are collected (Automated)
  • 6.3.3.13 Ensure file deletion events by users are collected (Automated)
  • 6.3.3.14 Ensure events that modify the system’s Mandatory Access Controls are collected (Automated)
  • 6.3.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected (Automated)
  • 6.3.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected (Automated)
  • 6.3.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected (Automated)
  • 6.3.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected (Automated)
  • 6.3.3.19 Ensure kernel module loading unloading and modification is collected (Automated)
  • 6.3.3.20 Ensure the audit configuration is immutable (Automated)
  • 6.3.3.21 Ensure the running and on disk configuration is the same (Manual)

2. Concept and Security Rationale

Auditd rules specify which operating-system events and system calls must be recorded by the kernel for auditing purposes. Logging changes to system time, which can invalidate log timelines, network configuration changes, failed file-access attempts, the use of administrative privileges, and kernel module changes is essential for intrusion detection and post-incident forensic investigations.

Finally, making the configuration immutable prevents an attacker from stopping or modifying logging rules while the system is running, even after obtaining root-level access.

3. Oracle Database Compatibility Review (RAC and Grid)

Potential performance and I/O impact: Monitoring all file deletions, such as unlink, or permission modifications can generate a significant volume of audit records. In Oracle Database environments, where temporary files and log files are frequently created and removed, this can cause an I/O bottleneck. When required, specific Oracle processes should be excluded from selected high-volume audit rules.

Critical immutability consideration: CIS requirement 6.3.3.20 requires the -e 2 setting at the end of the audit rules file. This setting locks the auditd configuration, and any rule modification requires a full server reboot. In Oracle production environments with high-availability requirements, it is recommended to retain -e 1 or change to -e 2 only after all performance tests have been completed.

4. Auditing the Current Configuration

This script checks whether the required audit rules exist and verifies the immutability mode.

The path of this script in GitHub is: modules/audit_26_Auditd_Rules.sh

If you are not familiar with Bash scripting, you may refer to the Bash for Oracle DBAs training published for database administrators. 

#!/bin/bash
# Script: audit26.sh
# Purpose: Audit Auditd Rules (CIS 6.3.3) for Oracle Linux

echo "=========================================================================="
echo " CIS Requirement: Auditd Rules Configuration (CIS 6.3.3)"
echo " - Ensure various audit rules are populated (sudo, time, network, etc.)."
echo " - Ensure audit configuration is immutable using '-e 2' (CIS 6.3.3.20)."
echo " Oracle Context & Exceptions:"
echo " - EXCEPTION: Setting rules to immutable (-e 2) locks them until reboot."
echo "   In Oracle DB/RAC production environments, this hinders troubleshooting."
echo "   ACTION: We accept '-e 1' (locked but mutable) to maintain stability"
echo "   and prevent unwanted node evictions or required downtime."
echo "=========================================================================="

AUDIT_STATUS="PASS"

check_rule() {
    local rule_desc="$1"
    local search_key="$2"
    # Added '--' so grep doesn't treat '-k' as a command-line option
    if grep -REq -- "$search_key" /etc/audit/rules.d/ 2>/dev/null; then
        echo "[PASS] Rule populated: $rule_desc"
    else
        echo "[FAIL] Rule missing: $rule_desc"
        AUDIT_STATUS="FAIL"
    fi
}

echo "Checking Audit Rules..."
check_rule "Sudoers changes (scope)" "-k scope"
check_rule "Sudo log file" "-k sudo_log_file"
check_rule "Time changes" "-k time-change"
check_rule "Network environment (system-locale)" "-k system-locale"
check_rule "User/Group info (identity)" "-k identity"
check_rule "Logins and logouts" "-k logins"
check_rule "File deletions" "-k delete"
check_rule "Kernel modules" "-k modules"

# Check Immutability Status
echo "Checking Immutability Flag..."
if grep -Eq -- "^\s*-e\s+2" /etc/audit/rules.d/*.rules 2>/dev/null; then
    echo "[PASS] Configuration is strictly immutable (-e 2) [CIS Standard]"
elif grep -Eq -- "^\s*-e\s+1" /etc/audit/rules.d/*.rules 2>/dev/null; then
    echo "[PASS] Configuration is locked (-e 1) [Oracle Best Practice Exception]"
else
    echo "[FAIL] Immutability flag (-e 1 or -e 2) is missing or set to 0"
    AUDIT_STATUS="FAIL"
fi

echo "--------------------------------------------------------------------------"
if [ "$AUDIT_STATUS" = "PASS" ]; then
    echo " Final Audit Status: PASS"
else
    echo " Final Audit Status: FAIL"
fi
echo "=========================================================================="

5. Applying the Configuration (Remediation Bash Script)

This script creates the standard CIS audit rules under /etc/audit/rules.d/ and updates the service configuration.

The path of this script in GitHub is: modules/remediate_26_Auditd_Rules.sh 

#!/bin/bash
# Script: audit26.sh
# Purpose: Audit Auditd Rules (CIS 6.3.3) for Oracle Linux

echo "=========================================================================="
echo " CIS Requirement: Auditd Rules Configuration (CIS 6.3.3)"
echo " - Ensure various audit rules are populated (sudo, time, network, etc.)."
echo " - Ensure audit configuration is immutable using '-e 2' (CIS 6.3.3.20)."
echo " Oracle Context & Exceptions:"
echo " - EXCEPTION: Setting rules to immutable (-e 2) locks them until reboot."
echo "   In Oracle DB/RAC production environments, this hinders troubleshooting."
echo "   ACTION: We accept '-e 1' (locked but mutable) to maintain stability"
echo "   and prevent unwanted node evictions or required downtime."
echo "=========================================================================="

AUDIT_STATUS="PASS"

check_rule() {
    local rule_desc="$1"
    local search_key="$2"
    # Added '--' so grep doesn't treat '-k' as a command-line option
    if grep -REq -- "$search_key" /etc/audit/rules.d/ 2>/dev/null; then
        echo "[PASS] Rule populated: $rule_desc"
    else
        echo "[FAIL] Rule missing: $rule_desc"
        AUDIT_STATUS="FAIL"
    fi
}

echo "Checking Audit Rules..."
check_rule "Sudoers changes (scope)" "-k scope"
check_rule "Sudo log file" "-k sudo_log_file"
check_rule "Time changes" "-k time-change"
check_rule "Network environment (system-locale)" "-k system-locale"
check_rule "User/Group info (identity)" "-k identity"
check_rule "Logins and logouts" "-k logins"
check_rule "File deletions" "-k delete"
check_rule "Kernel modules" "-k modules"

# Check Immutability Status
echo "Checking Immutability Flag..."
if grep -Eq -- "^\s*-e\s+2" /etc/audit/rules.d/*.rules 2>/dev/null; then
    echo "[PASS] Configuration is strictly immutable (-e 2) [CIS Standard]"
elif grep -Eq -- "^\s*-e\s+1" /etc/audit/rules.d/*.rules 2>/dev/null; then
    echo "[PASS] Configuration is locked (-e 1) [Oracle Best Practice Exception]"
else
    echo "[FAIL] Immutability flag (-e 1 or -e 2) is missing or set to 0"
    AUDIT_STATUS="FAIL"
fi

echo "--------------------------------------------------------------------------"
if [ "$AUDIT_STATUS" = "PASS" ]; then
    echo " Final Audit Status: PASS"
else
    echo " Final Audit Status: FAIL"
fi
echo "=========================================================================="

In the next part, we will cover Managing Auditd File Access .