Greetings,
I have a 64 bit EL 5.2 system that I have built and installed all of
the necessary packages for the latest audit (1.7.11-1), prelude and
prewikka. (Does anyone need any binary RPM packages?).
This all seems to be working fine on the central cluster server and now
I'm trying to set up clients in the cluster nodes to report their audit
information to the server. I've found the RHEL 5.3 release notes
where it says:
In addition to the listed enhancements, these
updated audit packages also include a new feature to allow a server to
aggregate the logs of remote systems. The following instructions can be
followed to enable this feature:
-
The
audispd-plugins package should be installed on all clients (but need
not be installed on the server), and the parameters for "remote_server"
and "port" should be set in the /etc/audisp/audisp-remote.conf
configuration file.
-
On the server, which aggregates
the logs, the "tcp_listen_port" parameter in the /etc/audit/auditd.conf
file must be set to the same port number as the clients.
-
Because the auditd daemon is
protected by SELinux, semanage (the SELinux policy management tool)
must also have the same port listed in its database. If the server and
client machines had all been configured to use port 1000, for example,
then running this command would accomplish this:
semanage port -a -t audit_port_t -p tcp 1000
-
The final step in
configuring remote log aggregation is to edit the /etc/hosts.allow
configuration file to inform tcp_wrappers which machines or subnets the
auditd daemon should allow connections from.
I'm on the step where I'm
trying to run the semanage command to let selinux know that port 60 (in
my case) is acceptable for audit to use but I get the following error
message when I run the command:
# semanage port -a -t audit_port_t -p tcp 60
libsepol.context_from_record: type audit_port_t is not defined
libsepol.context_from_record: could not create context structure
libsepol.port_from_record: could not create port structure for range
60:60 (tcp)
libsepol.sepol_port_modify: could not load port range 60 - 60 (tcp)
libsemanage.dbase_policydb_modify: could not modify record value
libsemanage.semanage_base_merge_components: could not merge local
modifications into policy
/usr/sbin/semanage: Could not add port tcp/60
I'm not much of a wiz at
selinux, but I can tell that the audit_port_t type doesn't exist. I'm
stuck here because:
1) I don;t know how to create new types in selinux
2) Even if I figured that out, I don't know how auditd would know to
use that.
I've looked at the auditd executable, it has types like this:
-rwxr-x--- root root system_u:object_r:auditd_exec_t
/sbin/auditd
Could someone give me some pointers and/or point me to something I
could read to get me going?
Thanks
Dan
--
Dan Gruhn, Group W Inc.
|
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
