Auditd

Kjøp Self-Hosted Protection
Live
Demo
auditd – systemrevisjon
Buffer: 01:48:20 Oppdater
Detected 8 login attempts from external IPs
Innlogginger i dag: 3  |  Sudo: 51  |  Blokkert: / 8  |  Bruker: admin
Innlogginger i dag
3
Eksterne innloggingsforsøk
8
Sudo i dag
51
Log
11
Eksterne innloggingsforsøk (8)
TidBrukerIP / VertTerminalStatus
2026-10-13 01:48:20 root 198.51.100.22 — Ikke blokkert
2026-10-12 23:58:32 root 198.51.100.16 — Ikke blokkert
2026-10-12 16:10:02 root 198.51.100.25 — Ikke blokkert
2026-10-12 04:19:08 root 198.51.100.33 — Ikke blokkert
2026-10-12 10:52:28 root 198.51.100.18 — Ikke blokkert
2026-10-12 19:08:40 root 198.51.100.19 — Ikke blokkert
2026-10-12 12:16:32 root 198.51.100.24 — Ikke blokkert
2026-10-11 14:38:04 root 198.51.100.23 — Ikke blokkert
Sudo-kommandoer i dag 51 significant / 51 total
TidBrukerKommandoResultat
2026-10-13 01:48:20 admin /usr/bin/systemctl status fail2ban OK
2026-10-13 01:10:54 admin /usr/bin/apt update OK
2026-10-13 00:50:46 admin /usr/sbin/ufw status OK
2026-10-12 23:42:44 admin /usr/bin/tail -f /var/log/auth.log OK
2026-10-13 00:49:16 admin /usr/bin/docker ps OK
2026-10-13 00:50:20 admin /usr/sbin/fail2ban-client status OK
2026-10-12 23:29:08 admin /usr/bin/systemctl restart nginx OK
2026-10-12 21:41:42 admin /usr/bin/journalctl -u sshd OK
2026-10-12 20:45:40 admin /usr/sbin/aa-status OK
2026-10-12 20:36:29 admin /usr/bin/crontab -l OK
2026-10-12 19:10:20 admin /usr/sbin/lynis audit system OK
2026-10-12 19:42:02 admin /usr/bin/cscli decisions list OK
2026-10-12 16:18:44 admin /usr/bin/systemctl status fail2ban OK
2026-10-12 18:48:00 admin /usr/bin/apt update OK
2026-10-12 18:02:50 admin /usr/sbin/ufw status OK
2026-10-12 23:07:20 admin /usr/bin/tail -f /var/log/auth.log OK
2026-10-12 18:22:28 admin /usr/bin/docker ps OK
2026-10-12 20:26:11 admin /usr/sbin/fail2ban-client status OK
2026-10-12 16:55:14 admin /usr/bin/systemctl restart nginx OK
2026-10-12 19:03:00 admin /usr/bin/journalctl -u sshd OK
2026-10-12 18:15:40 admin /usr/sbin/aa-status OK
2026-10-12 12:14:56 admin /usr/bin/crontab -l OK
2026-10-12 09:15:02 admin /usr/sbin/lynis audit system OK
2026-10-12 08:03:26 admin /usr/bin/cscli decisions list OK
2026-10-12 07:34:20 admin /usr/bin/systemctl status fail2ban OK
2026-10-12 11:26:40 admin /usr/bin/apt update OK
2026-10-12 09:19:02 admin /usr/sbin/ufw status OK
2026-10-12 10:09:11 admin /usr/bin/tail -f /var/log/auth.log OK
2026-10-12 06:52:56 admin /usr/bin/docker ps OK
2026-10-12 12:04:44 admin /usr/sbin/fail2ban-client status OK
2026-10-12 17:59:20 admin /usr/bin/systemctl restart nginx OK
2026-10-12 16:41:42 admin /usr/bin/journalctl -u sshd OK
2026-10-12 00:20:20 admin /usr/sbin/aa-status OK
2026-10-12 12:08:17 admin /usr/bin/crontab -l OK
2026-10-12 04:17:28 admin /usr/sbin/lynis audit system OK
2026-10-12 05:13:25 admin /usr/bin/cscli decisions list OK
2026-10-12 00:23:44 admin /usr/bin/systemctl status fail2ban OK
2026-10-12 16:06:49 admin /usr/bin/apt update OK
2026-10-12 01:21:32 admin /usr/sbin/ufw status OK
2026-10-12 18:35:26 admin /usr/bin/tail -f /var/log/auth.log OK
2026-10-12 17:35:40 admin /usr/bin/docker ps OK
2026-10-11 23:57:10 admin /usr/sbin/fail2ban-client status OK
2026-10-11 23:11:38 admin /usr/bin/systemctl restart nginx OK
2026-10-12 13:05:48 admin /usr/bin/journalctl -u sshd OK
2026-10-12 12:05:32 admin /usr/sbin/aa-status OK
2026-10-11 23:55:05 admin /usr/bin/crontab -l OK
2026-10-11 17:44:00 admin /usr/sbin/lynis audit system OK
2026-10-12 01:18:48 admin /usr/bin/cscli decisions list OK
2026-10-11 23:58:44 admin /usr/bin/systemctl status fail2ban OK
2026-10-12 04:35:58 admin /usr/bin/apt update OK
2026-10-12 02:29:10 admin /usr/sbin/ufw status OK
Innlogginger / utlogginger i dag (3)
TidTypeBrukerIP / VertResultatStatus
2026-10-13 01:48:20 USER_LOGIN admin 203.0.113.20 OK Ikke blokkert
2026-10-12 16:18:55 USER_LOGIN admin 203.0.113.20 OK Ikke blokkert
2026-10-12 10:50:38 USER_LOGIN admin 203.0.113.20 OK Ikke blokkert
/var/log/audit/audit.log

Et Auditd Web UI der ausearch gjør arbeidet tungt

Linux-revisjonsdemonen registrerer nøyaktig det du ber om og ingenting mer, noe som gjør den til det mest presise verktøyet på serveren og det mest ubehagelige å spørre ut. ausearch og aureport virker, men forutsetter at du allerede vet hva du leter etter og husker flagget som finner det.

Denne siden viser revisjonsreglene som er lastet inn nå, stiene og systemkallene som overvåkes, samt de nyeste hendelsene med type, ansvarlig prosess og utfall. Å se de innlastede reglene teller like mye som å se hendelsene: et tomt regelsett er den vanligste grunnen til at auditd ser ut til å kjøre uten å registrere noe av verdi.

Et fornuftig startsett overvåker /etc/passwd og /etc/shadow for endringer, /etc/ssh/sshd_config for redigeringer, og kjøring av binærfiler for rettighetsheving. Disse fire dekker sporene innbrudd pleier å etterlate, uten å begrave loggen i støy fra vanlig arbeid.