Question

can I get help step by step to Configure Linux to log security events of interest

Answer 1

Hi,

I tried to provide a detailed explanation. Please rate my answer if you find it usefull.

The default location for log files in Linux is /var/log.

You can view the list of log files in this directory with a simple ls -l /var/log command.

For Security related event log file you will find under /var/log/secure.

At the heart of the logging mechanism is the rsyslog daemon. This service is responsible for listening to log messages from different parts of a Linux system and routing the message to an appropriate log file in the /var/log directory. It can also forward log messages to another Linux server.

The rsyslog daemon gets its configuration information from the rsyslog.conf file. The file is located under the /etc directory.

Basically, the rsyslog.conf file tells the rsyslog daemon where to save its log messages. This instruction comes from a series of two-part lines within the file.

This file can be found at rsyslog.d/50-default.conf on ubuntu.

The two part instruction is made up of a selector and an action. The two parts are separated by white space.

The selector part specifies what’s the source and importance of the log message and the action part says what to do with the message.

The selector itself is again divided into two parts separated by a dot (.). The first part before the dot is called *acility (the origin of the message) and the second part after the dot is called priority (the severity of the message).

Together, the facility/priority and the action pair tell rsyslog what to do when a log message matching the criteria is generated.

You need to add below line in the configuration file. Debian saves all security/authorization level messages in /var/log/auth.log whereas CentOS saves it under /var/log/secure.

# The authpriv file has restricted access.  
authpriv.*                                              /var/log/secure

OR

auth,authpriv.*                                        /var/log/auth.log

auth, authpriv: This means Messages coming from authorization and security related events will be logged under above path.

in Ubuntu:

#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf  
....  
....    
$IncludeConfig /etc/rsyslog.d/*.conf