Fixes #225 : Option to configure audit rules from this module itself #226

djmgit · 2020-03-09T14:50:35Z

The PR implements the option to configure audit rules from the Wazuh module
it self. This also moves audit configuration and installation to a separate
pp file for better management.

…self The PR implements the option to configure audit rules from the Wazuh module it self. This also moves audit configuration and installation to a separate pp file for better management.

djmgit · 2020-03-09T15:32:59Z

@rshad Please review.

rshad · 2020-03-10T10:16:41Z

Hi @djmgit !

Thank you for contributing to Wazuh, we really appreciate it.

I see you've done a great work here, it looks really interesting.

I'll review it during this week for sure.

I'll be back soon.

Kr,

Rshad

rshad · 2020-03-18T15:21:34Z

Hi all!

Having set:

$audit_manage_rules                = true

The following template should be rendered.

wazuh-puppet/templates/audit_rules.erb

Lines 1 to 18 in 855de23

 ## First rule - delete all 

 -D 

 ## Increase the buffers to survive stress events. 

 ## Make this bigger for busy systems 

 -b <%= @audit_buffer_bytes %> 

 ## This determine how long to wait in burst of events 

 --backlog_wait_time <%= @audit_backlog_wait_time %> 

 ## Set failure mode to syslog 

 -f 1 

 <% if !@audit_rules.empty? -%> 

  <% @audit_rules.each do |audit_rule| -%> 

  <%= audit_rule %> 

  <%- end -%> 

 <%- end -%>

As we checked, the template was rendered correctly.

/etc/audit/rules.d/audit.rules

## First rule - delete all
-D

## Increase the buffers to survive stress events.
## Make this bigger for busy systems
-b 8192

## This determine how long to wait in burst of events
--backlog_wait_time 0

## Set failure mode to syslog
-f 1

Related Puppet Log

Info: Loading facts
Info: Caching catalog for agent-client-1
Info: Applying configuration version '1584538768'
Notice: /Stage[main]/Wazuh::Audit/Package[Installing Audit...]/ensure: created
Notice: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]/content:
--- /etc/audit/rules.d/audit.rules      2017-10-19 22:46:39.000000000 +0000
+++ /tmp/puppet-file20200318-2962-xpvkih        2020-03-18 13:39:55.954986245 +0000
@@ -1,14 +1,13 @@
-# This file contains the auditctl rules that are loaded
-# whenever the audit daemon is started via the initscripts.
-# The rules are simply the parameters that would be passed
-# to auditctl.
-
-# First rule - delete all
+## First rule - delete all
 -D

-# Increase the buffers to survive stress events.
-# Make this bigger for busy systems
--b 320
+## Increase the buffers to survive stress events.
+## Make this bigger for busy systems
+-b 8192
+
+## This determine how long to wait in burst of events
+--backlog_wait_time 0

-# Feel free to add below this line. See auditctl man page
+## Set failure mode to syslog
+-f 1


Info: Computing checksum on file /etc/audit/rules.d/audit.rules
Info: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]: Filebucketed /etc/audit/rules.d/audit.rules to puppet with sum f9869e1191838c461f5b9051c78a638d
Notice: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]/content: content changed '{md5}f9869e1191838c461f5b9051c78a638d' to '{md5}9967a3542c449b61d688a4f4b465cdfa'
Notice: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]/mode: mode changed '0640' to '0644'
Info: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]: Scheduling refresh of Service[auditd]
Info: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]: Scheduling refresh of Service[auditd]
Notice: /Stage[main]/Wazuh::Audit/Service[auditd]: Triggered 'refresh' from 2 events

Adapted audit_rules.pp and the rules array

Hi @djmgit,

I think having the template without already defined rules would be better, and these rules you consider that would come by default when enabling the rules, I moved them to the file param_agent.pp to be defined in the array:

$audit_rules                       = []

As follows,

$audit_rules                       = [
        "-b ${audit_buffer_bytes}",
        "--backlog_wait_time ${audit_backlog_wait_time}",
        "-f 1"
]

Also, I adapted the template to be as follows,

<% if !@audit_rules.empty? -%>
<% @audit_rules.each do |audit_rule| -%>
<%= audit_rule %>
<%- end -%>
<%- end -%>

In this case, I re-installed the agent, and Puppet output is:

root@agent-client-1:~# puppet agent -t
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for agent-client-1
Info: Applying configuration version '1584544019'
Notice: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]/content:
--- /etc/audit/rules.d/audit.rules      2020-03-18 15:05:49.611350290 +0000
+++ /tmp/puppet-file20200318-17015-ggysa4       2020-03-18 15:07:10.183616289 +0000
@@ -0,0 +1,5 @@
+-b 8192
+--backlog_wait_time 0
+-f 1
+

Info: Computing checksum on file /etc/audit/rules.d/audit.rules
Info: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]: Filebucketed /etc/audit/rules.d/audit.rules to puppet with sum d41d8cd98f00b204e9800998ecf8427e
Notice: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]/content:

Notice: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]/content: content changed '{md5}d41d8cd98f00b204e9800998ecf8427e' to '{md5}a11120ea77870ba2c05b40db0b7fc0e1'
Info: /Stage[main]/Wazuh::Audit/File[Configure audit.rules]: Scheduling refresh of Service[auditd]
Notice: /Stage[main]/Wazuh::Audit/Service[auditd]: Triggered 'refresh' from 1 events
Notice: Applied catalog in 1.41 seconds

/etc/audit/rules.d/audit.rules

-b 8192
--backlog_wait_time 0
-f 1

I finally decided to remove -D to not delete the already loaded rules in audit.

Kr,

Rshad

rshad

I added some changes.
c0cfbd1
5972eee
16619a4

rshad · 2020-03-18T15:23:32Z

manifests/params_agent.pp

+ $audit_manage_rules = false
+ $audit_buffer_bytes = "8192"
+ $audit_backlog_wait_time = "0"
+ $audit_rules = []


I would prefer to define the default rules you put in the template into this array, audit_rules.

I already changed it in 5972eee

Thanks,

rshad · 2020-03-18T15:24:25Z

templates/audit_rules.erb

+## First rule - delete all
+-D
+
+## Increase the buffers to survive stress events.
+## Make this bigger for busy systems
+-b <%= @audit_buffer_bytes %>
+
+## This determine how long to wait in burst of events
+--backlog_wait_time <%= @audit_backlog_wait_time %>
+
+## Set failure mode to syslog
+-f 1
+


As I commented in the previous comment, these rules should be defined in params_agent.pp.

I changed it in 5972eee

Thanks.

rshad · 2020-03-18T15:31:10Z

manifests/params_agent.pp

+ $audit_buffer_bytes = "8192"
+ $audit_backlog_wait_time = "0"
+ $audit_rules = [
+ '-D',


I also removed -D to not delete the already loaded audit rules.

Done in 16619a4

Thank you

djmgit · 2020-03-18T18:47:47Z

@rshad HI, the changes you made are very much reasonable.
The only thing that might be pointed out here is, now when a user of this module would want to add adudit rules from this puppet config, he/she would always have to precede his rules in the list by:
"-b audit_buffer_bytes",
"--backlog_wait_time audit_backlog_wait_time",
"-f 1",
since the user's list will override the default rule list and also since there will be no default value for these options in the rules file.

rshad · 2020-03-19T09:30:24Z

@rshad HI, the changes you made are very much reasonable.
The only thing that might be pointed out here is, now when a user of this module would want to add audit rules from this puppet config, he/she would always have to precede his rules in the list by:
"-b audit_buffer_bytes",
"--backlog_wait_time audit_backlog_wait_time",
"-f 1",
since the user's list will override the default rule list and also since there will be no default value for these options in the rules file.

Hi @djmgit !

You're right. I would think about adding control variables to enable or not each one of the 3 rules we consider as default

"-b audit_buffer_bytes",
"--backlog_wait_time audit_backlog_wait_time",
"-f 1",

In this case, the user would have more control about what to add or not. Also, I will work to make the configuration add rules to the already existing ones without overwriting the original rules file.

I will try to get it today.

Kr,

Rshad

rshad · 2020-03-20T15:23:46Z

Hi @djmgit !

We decided to remove the template for audit rules and changed from overwriting to appending to the rules file.

wazuh-puppet/manifests/audit.pp

Lines 33 to 39 in 697bad3

 $audit_rules.each |String $rule| { 

 file_line { "Append rule ${rule} to /etc/audit/rules.d/audit.rules": 

 path => '/etc/audit/rules.d/audit.rules', 

 line => $rule, 

 require => File['/etc/audit/rules.d/audit.rules'] 

 } 

 }

Testing Log

Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for agent-client-1
Info: Applying configuration version '1584576544'
Notice: /Stage[main]/Wazuh::Audit/File_line[Append rule -b 8192 to /etc/audit/rules.d/audit.rules]/ensure: created
Notice: /Stage[main]/Wazuh::Audit/File_line[Append rule --backlog_wait_time 0 to /etc/audit/rules.d/audit.rules]/ensure: created
Notice: /Stage[main]/Wazuh::Audit/File_line[Append rule -f 1 to /etc/audit/rules.d/audit.rules]/ensure: created
Notice: Applied catalog in 1.08 seconds

Kr,

Rshad

Fixes wazuh#225 : Option to configure audit rules from this module it…

855de23

…self The PR implements the option to configure audit rules from the Wazuh module it self. This also moves audit configuration and installation to a separate pp file for better management.

rshad self-assigned this Mar 10, 2020

rshad added community enhancement labels Mar 10, 2020

rshad added this to the Sprint-108 milestone Mar 11, 2020

rshad self-requested a review March 18, 2020 12:00

rshad added 2 commits March 18, 2020 16:20

Remove default rules from audit rules temp.

c0cfbd1

Define default audit rules in agent params

5972eee

rshad approved these changes Mar 18, 2020

View reviewed changes

Remove -D "delete loaded rules" from audit rules var.

16619a4

rshad approved these changes Mar 18, 2020

View reviewed changes

rshad changed the base branch from master to devel March 18, 2020 15:42

Merge branch 'devel' into audit_config

e5d2507

manuasir linked an issue Mar 18, 2020 that may be closed by this pull request

Separate file for audit and option to configure audit rules from this module itself #225

Closed

Fix variable name in agent.pp

1f864e6

rshad force-pushed the audit_config branch from 907ca77 to 1f864e6 Compare March 20, 2020 13:17

Append to audit rules file instead of overwriting & removed the template

697bad3

rshad approved these changes Mar 20, 2020

View reviewed changes

manuasir merged commit 6cc7e40 into wazuh:devel Mar 20, 2020

manuasir removed this from the Sprint-108 milestone Mar 20, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes #225 : Option to configure audit rules from this module itself #226

Fixes #225 : Option to configure audit rules from this module itself #226

djmgit commented Mar 9, 2020

djmgit commented Mar 9, 2020

rshad commented Mar 10, 2020

rshad commented Mar 18, 2020 •

edited

Loading

rshad left a comment •

edited

Loading

rshad Mar 18, 2020

rshad Mar 18, 2020

rshad Mar 18, 2020 •

edited

Loading

djmgit commented Mar 18, 2020

rshad commented Mar 19, 2020

rshad commented Mar 20, 2020

Fixes #225 : Option to configure audit rules from this module itself #226

Fixes #225 : Option to configure audit rules from this module itself #226

Conversation

djmgit commented Mar 9, 2020

djmgit commented Mar 9, 2020

rshad commented Mar 10, 2020

rshad commented Mar 18, 2020 • edited Loading

rshad left a comment • edited Loading

Choose a reason for hiding this comment

rshad Mar 18, 2020

Choose a reason for hiding this comment

rshad Mar 18, 2020

Choose a reason for hiding this comment

rshad Mar 18, 2020 • edited Loading

Choose a reason for hiding this comment

djmgit commented Mar 18, 2020

rshad commented Mar 19, 2020

rshad commented Mar 20, 2020

rshad commented Mar 18, 2020 •

edited

Loading

rshad left a comment •

edited

Loading

rshad Mar 18, 2020 •

edited

Loading