Skip to content

Instantly share code, notes, and snippets.

@antsmartian
Created July 12, 2012 08:16
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save antsmartian/3096637 to your computer and use it in GitHub Desktop.
Save antsmartian/3096637 to your computer and use it in GitHub Desktop.
Shell script for auditing in Linux
#!/bin/bash
sudo apt-get install auditd
sudo auditd
#Setting up system parameters
sudo auditctl -b 1000
sudo auditctl -f 1
sudo auditctl -r 5
sudo auditctl -e 1
#Setting up auditing for Files
sudo auditctl -w /etc/shadow
sudo auditctl -w /etc -p wx
sudo auditctl -w /etc/passwd -k fk_passwd -p rwxa
#Setting up for System Call
sudo auditctl -a entry,always -S mkdir
sudo auditctl -a entry,always -S access -F a1=4
sudo auditctl -a exit,always -S ipc -F a0=2
@bufferunknown
Copy link

Kindly explain little....

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment