For Teachers · Back to the Module · Print with your browser's Print command.

P21 Teacher Answer Key: Audit Logging and Monitoring Depth

Teacher Answer Key (about 30 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P16

Learning Objectives

• [ ] Explain the difference between a running audit daemon and a useful audit trail.
• [ ] Read an audit rule file and say which events it records (identity files, logins, time changes, kernel modules, privileged commands).
• [ ] Explain why the immutable flag, log file permissions and full-disk actions protect the evidence an investigation depends on.
• [ ] Explain why journald persistence, compression and remote forwarding matter.

Key Terms

Write each definition in your own words.

• Audit Rule: One line in the Linux audit configuration that tells the kernel which file writes or system calls to record, with the user, process and time attached.
• Audit Trail: The ordered record of security-relevant events (logins, privilege use, changes to key files) that lets an investigator reconstruct what happened and who did it.
• Immutable Audit Configuration: The -e 2 flag at the end of the audit rules, which locks them until the next reboot so that even root cannot switch auditing off quietly.
• Log Forwarding: Sending a copy of log messages to another machine as they are written, so an intruder who edits the local logs does not reach the only copy.
• Persistent Journal: A systemd journal stored on disk (Storage=persistent, under /var/log/journal) rather than only in memory, so it survives a reboot.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-AUD- --out p21
2. Open internal/lab/fixtures_audit_pam_pkg.go and compare the vulnerable audit.rules (four housekeeping lines) with the hardened 50-lab.rules. For each failed HOST-AUD check, find the rule line that makes it pass.
3. Write one audit rule of your own for a file you care about (for example /etc/ssh/sshd_config) and explain which HOST-AUD check would notice its absence.
4. On a test machine you own: sudo openvapt scan --only HOST-AUD- and read auditctl -l alongside the report.

Self-Check Questions

1. auditd is active but /etc/audit/rules.d contains only -D and -b 8192. What is being recorded?

• [ ] a) Every file change on the system
• [x] b) Almost nothing: there are no watch or system call rules
• [ ] c) Only failed logins
• [ ] d) Only kernel messages
• Answer: b. Those lines clear the rules and set a buffer size. Without -w or -a rules, there is no audit trail.

1. What does -e 2 at the end of the audit rules do?

• [ ] a) Enables two audit log files
• [x] b) Locks the rules until the next reboot so root cannot remove them
• [ ] c) Sets the log level to 2
• [ ] d) Turns auditing off
• Answer: b. The immutable flag means the only way to change the rules is a reboot, which is itself a logged event.

1. Why forward logs to another machine when the local disk has plenty of space?

• [ ] a) To save disk space
• [x] b) Because an intruder with root can edit or delete the local copy
• [ ] c) Because journald cannot write to disk
• [ ] d) Because remote logs are faster to search
• Answer: b. A copy that already left the machine is the one an investigation can trust.

1. journald.conf has Storage=volatile. What happens to the journal at reboot?

• [ ] a) It is compressed
• [ ] b) It is kept in /var/log/journal
• [x] c) It is lost: volatile means memory only
• [ ] d) It is forwarded to another machine
• Answer: c. Set Storage=persistent (and create /var/log/journal) so the journal survives.

1. Which events should the audit rules record?

• [x] a) Changes to identity files, logins, time changes, kernel modules and privileged commands
• [ ] b) Only web server requests
• [ ] c) Only failed SSH logins
• [ ] d) Every keystroke of every user
• Answer: a. These are the events an investigation needs to show who changed what and when.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-92, Guide to Computer Security Log Management: https://csrc.nist.gov/pubs/sp/800/92/final
• NIST SP 800-53 Rev. 5, AU family (Audit and Accountability): https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
• auditctl(8), Linux man-pages: https://man7.org/linux/man-pages/man8/auditctl.8.html
• journald.conf(5), systemd: https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.