Untitled

Sweetening

Dec 6th, 2024

Never

Add comment

Not a member of Pastebin yet? Sign Up, it unlocks many cool features!

text 2.67 KB | None | 0 0

raw download clone embed print report

#!/bin/bash
# Automated Kernel Audit Script for Debian 12 Bookworm
# Designed for high-security auditing
# Ensure the audit daemon is installed and running
echo "Installing and starting the audit daemon..."
sudo apt update && sudo apt install -y auditd
# Enable auditd to start on boot
sudo systemctl enable auditd
sudo systemctl start auditd
# Set auditctl rules for kernel modules, exec calls, and syscall executions
echo "Setting up auditing rules..."
# Audit kernel module loading/unloading (insmod, rmmod, modprobe)
sudo auditctl -w /sbin/insmod -p x -k kernel-modules
sudo auditctl -w /sbin/rmmod -p x -k kernel-modules
sudo auditctl -w /sbin/modprobe -p x -k kernel-modules
# Audit system calls related to execve for executable tracking
sudo auditctl -a always,exit -F arch=b64 -S execve -k syscall-exec
sudo auditctl -a always,exit -F arch=b32 -S execve -k syscall-exec
# Audit changes to critical system files (e.g., /etc, /bin, /sbin, /usr)
sudo auditctl -w /etc -p wa -k config-changes
sudo auditctl -w /bin -p wa -k bin-exec
sudo auditctl -w /sbin -p wa -k sbin-exec
sudo auditctl -w /usr -p wa -k usr-changes
# Audit for changes to user accounts (e.g., useradd, userdel, usermod)
sudo auditctl -w /usr/sbin/useradd -p x -k user-modifications
sudo auditctl -w /usr/sbin/userdel -p x -k user-modifications
sudo auditctl -w /usr/sbin/usermod -p x -k user-modifications
# Audit for root privilege escalation attempts (e.g., sudo, su)
sudo auditctl -w /usr/bin/sudo -p x -k sudo-exec
sudo auditctl -w /bin/su -p x -k su-exec
# Audit system boot and shutdown logs
sudo auditctl -w /var/log/boot.log -p wa -k boot-logs
sudo auditctl -w /var/log/shutdown.log -p wa -k shutdown-logs
# Enable audit logging for all system calls (for comprehensive auditing)
sudo auditctl -a always,exit -F arch=b64 -S all -k syscalls-all
sudo auditctl -a always,exit -F arch=b32 -S all -k syscalls-all
# Start monitoring kernel activities in real-time
echo "Starting real-time audit monitoring..."
sudo ausearch -m avc -i &
# Check audit logs for any suspicious activities
echo "Checking audit logs for suspicious activities..."
sudo ausearch -k kernel-modules
sudo ausearch -k syscall-exec
sudo ausearch -k config-changes
sudo ausearch -k bin-exec
sudo ausearch -k sbin-exec
sudo ausearch -k usr-changes
sudo ausearch -k user-modifications
sudo ausearch -k sudo-exec
sudo ausearch -k su-exec
sudo ausearch -k boot-logs
sudo ausearch -k shutdown-logs
sudo ausearch -k syscalls-all
# Print the status of the audit daemon
echo "Audit daemon status:"
sudo systemctl status auditd
echo "Audit configuration complete. Monitoring and logging in progress."
echo "Done!"

Add Comment

Please, Sign In to add comment