From owner-freebsd-hackers@freebsd.org Thu Oct 6 19:19:48 2016 Return-Path: Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id EA7A8BECBB5 for ; Thu, 6 Oct 2016 19:19:48 +0000 (UTC) (envelope-from mpp302@gmail.com) Received: from mail-lf0-f43.google.com (mail-lf0-f43.google.com [209.85.215.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7C62AB7E for ; Thu, 6 Oct 2016 19:19:48 +0000 (UTC) (envelope-from mpp302@gmail.com) Received: by mail-lf0-f43.google.com with SMTP id l131so24906579lfl.2 for ; Thu, 06 Oct 2016 12:19:48 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Ez+0XQK9FbZuLe0bt7mWug/3GC+uOa7+PfiMS/BU1Bw=; b=Wdc8u+JFqhS6jA/kaYh+iKYMv7ZPh5hVzXoP1FD102lclyh8kwrjBzgV8TtGpJrxW1 h7G/Fs66pW3Zc3QakY9BMjgRFT3l5HODdizT78koQDHGVHA0PZ2sW740hwXQSz0s24sg HVpTLgmSRXzY4V28tfETtXHPverg1ilvYMF0Q7mf2yeHAFuFUcnsNGvrQgnXhPOmYBW+ r1irdPjBIldrNQuTSAl55UnnrdmfoTONaxNzL+dC7FBiiagmEkSZr7H42L3mLQfwWuBD 2oITZ5xucEVS8psrk/D8Xf4f19CWoSllHfpHkFqfrpumuFvKy66aW+nivR2FkSmkGtJV 7asA== X-Gm-Message-State: AA6/9Rl4766dVAAJFD8sCuXoraiszJc3a7enwXT6LR1lMgDSYBsrlCEs+Kr3BfI6xPM1YA== X-Received: by 10.25.72.14 with SMTP id v14mr7180035lfa.12.1475781284191; Thu, 06 Oct 2016 12:14:44 -0700 (PDT) Received: from [192.168.0.15] (87-207-152-10.dynamic.chello.pl. [87.207.152.10]) by smtp.gmail.com with ESMTPSA id f9sm2900082lji.19.2016.10.06.12.14.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 06 Oct 2016 12:14:42 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.0 \(3226\)) Subject: Re: Using Audit Framework and praudit From: Mateusz Piotrowski <0mp@FreeBSD.org> In-Reply-To: Date: Thu, 6 Oct 2016 21:14:41 +0200 Cc: mokhi Content-Transfer-Encoding: 7bit Message-Id: References: To: freebsd-hackers@freebsd.org X-Mailer: Apple Mail (2.3226) X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Oct 2016 19:19:49 -0000 Hi, On 6 Oct 2016, at 18:59, mokhi wrote: > For using "The audit framework", should I rebuild my kernel to use > "praudit" to log exec or syscall events ? > I used the way that handbook says to use praudit, but it only shows me > logs on authentications with "su" and stop/starting "auditd" service, > and there's no any other logs. I guess that there's no need to recompile anything since your praudit seems to be working as expected. > Any ideas what other things should i do ? Are you sure you've modified /etc/security/audit_control? It's the file where you can configure what events the system should log. See audit_control(5) and the handbook[1] for more details. Cheers, -m [1]: https://www.freebsd.org/doc/handbook/audit-config.html