Skip to content

Commit 041010b

Browse files
drizzenticdrizzentic
authored
Merge pull request #314 from jembi/auditd-logging
Add auditd logging to platform for intrusion detection
2 parents 97ba293 + 4d63774 commit 041010b

File tree

7 files changed

+375
-42
lines changed

7 files changed

+375
-42
lines changed

‎infrastructure/ansible/README.md‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,19 @@
1212

1313
## Infrastructure and Servers
1414

15-
Please see the `/inventories/{ENVIRONMENT}/hosts` file for IP details of the designated services. Set these to the server that you created via terraform.
15+
Please see the `/inventories/{ENVIRONMENT}/hosts` file for IP details of the designated services. Set these to the server's domain name/s that you created via terraform.
1616

1717
## Ansible
1818

1919
### SSH Access
2020

21-
To authenticate yourself on the remote servers your ssh key will need to be added to the `sudoers` var in the _/inventories/{ENVIRONMENT}/group_vars/all.yml_.
21+
To authenticate users and to allow them to have sudo access on the remote servers your ssh key will need to be added to the `sudoers` var in the _/inventories/{ENVIRONMENT}/group_vars/all.yml_.
2222

23-
To have docker access you need to add your ssh key to the `docker_users` var in the _/inventories/{ENVIRONMENT}/group_vars/all.yml_.
23+
To authenticate users and to allow them to have docker access you need to add your ssh key to the `docker_users` var in the _/inventories/{ENVIRONMENT}/group_vars/all.yml_.
2424

25-
An authorised user will need to run the `provision_servers.yml` playbook to add your ssh key to the servers.
25+
Ensure that you remove all users that you don't want to have access. The default development files have a bunch of Jembi staff's user credentials.
26+
27+
An pre-authorised user will need to run the `provision_servers.yml` playbook the first time to add your ssh key to the servers.
2628

2729
### Configuration
2830

@@ -32,6 +34,8 @@ Before running the ansible script add the server to your known hosts file else a
3234
ssh-keyscan -H <host> >> ~/.ssh/known_hosts
3335
```
3436

37+
Next, ensure that you configure the `firewall_subnet_restriction` property of the _/inventories/{ENVIRONMENT}/group_vars/all.yml_ file if you are setting up multiple nodes in a Docker swarm. Docker swarm nodes need to communicate with each other, this property adds a restriction on the software firewall on each node (UFW) which only allow that communication to happen on the particular subset specified by this property.
38+
3539
To run a playbook you should do:
3640

3741
```bash

‎infrastructure/ansible/playbooks/provision_servers.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,4 @@
44
- common
55
- docker
66
- ufw
7+
- auditd

‎infrastructure/ansible/roles/auditd/tasks/main.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
- name: "install auditd"
3+
apt:
4+
name: auditd
5+
state: latest
6+
7+
- name: "fetch best practice Auditd config"
8+
get_url:
9+
url: https://raw.githubusercontent.com/Neo23x0/auditd/master/audit.rules
10+
dest: /etc/audit/rules.d/audit.rules
11+
12+
- name: Ensure name_format is set to HOSTNAME
13+
lineinfile:
14+
path: /etc/audit/auditd.conf
15+
regexp: '^name_format\s*='
16+
line: "name_format = HOSTNAME"
17+
state: present
18+
19+
- name: "restart auditd service"
20+
ansible.builtin.service:
21+
name: auditd
22+
state: restarted

‎infrastructure/ansible/roles/docker/handlers/main.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
---
2-
- include: reload_ufw.yml
3-
- include: reload_docker.yml
4-
- include: restart_docker.yml
2+
- import_tasks: reload_ufw.yml
3+
- import_tasks: reload_docker.yml
4+
- import_tasks: restart_docker.yml

‎monitoring/docker-compose.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ services:
6464
source: openhim_transactions_dashboard.json
6565
- target: /etc/grafana/provisioning/dashboards/containers/logging-universal-dashboard_rev1.json
6666
source: logging-universal-dashboard_rev1.json
67+
- target: /etc/grafana/provisioning/dashboards/security/auditlogs.json
68+
source: auditlogs.json
6769
networks:
6870
keycloak:
6971
reverse-proxy:
@@ -228,6 +230,11 @@ configs:
228230
name: logging-universal-dashboard_rev1.json-${logging_universal_dashboard_rev1_json_DIGEST:?err}
229231
labels:
230232
name: grafana
233+
auditlogs.json:
234+
file: ./grafana/dashboards/security/auditlogs.json
235+
name: auditlogs.json-${auditlogs_json_DIGEST:?err}
236+
labels:
237+
name: grafana
231238
prometheus.yml:
232239
file: ./prometheus/prometheus.yml
233240
name: prometheus.yml-${prometheus_yml_DIGEST:?err}

‎monitoring/grafana/dashboards/security/auditlogs.json‎

Lines changed: 277 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,277 @@
1+
{
2+
"annotations": {
3+
"list": [
4+
{
5+
"builtIn": 1,
6+
"datasource": {
7+
"type": "grafana",
8+
"uid": "-- Grafana --"
9+
},
10+
"enable": true,
11+
"hide": true,
12+
"iconColor": "rgba(0, 211, 255, 1)",
13+
"name": "Annotations & Alerts",
14+
"target": {
15+
"limit": 100,
16+
"matchAny": false,
17+
"tags": [],
18+
"type": "dashboard"
19+
},
20+
"type": "dashboard"
21+
}
22+
]
23+
},
24+
"editable": true,
25+
"fiscalYearStartMonth": 0,
26+
"graphTooltip": 0,
27+
"links": [],
28+
"liveNow": false,
29+
"panels": [
30+
{
31+
"datasource": {
32+
"type": "datasource",
33+
"uid": "grafana"
34+
},
35+
"gridPos": {
36+
"h": 4,
37+
"w": 24,
38+
"x": 0,
39+
"y": 0
40+
},
41+
"id": 6,
42+
"options": {
43+
"code": {
44+
"language": "plaintext",
45+
"showLineNumbers": false,
46+
"showMiniMap": false
47+
},
48+
"content": "# Notes\n\n* Some `proctitles` are hex encoded due to the posibility of special chars. Use a hex to ascii decoder to view these.\n* Multiple lines might refer to the same event, in that case the audit identifier (i.e. `msg=audit(...:...)`) will be the same. Use the find input to easily see all line for an event by searching for this audit identifier.",
49+
"mode": "markdown"
50+
},
51+
"pluginVersion": "9.2.3",
52+
"title": "Notes",
53+
"type": "text"
54+
},
55+
{
56+
"datasource": {
57+
"type": "loki",
58+
"uid": "P00201832B18B88C3"
59+
},
60+
"fieldConfig": {
61+
"defaults": {
62+
"custom": {
63+
"hideFrom": {
64+
"legend": false,
65+
"tooltip": false,
66+
"viz": false
67+
},
68+
"scaleDistribution": {
69+
"type": "linear"
70+
}
71+
}
72+
},
73+
"overrides": []
74+
},
75+
"gridPos": {
76+
"h": 6,
77+
"w": 24,
78+
"x": 0,
79+
"y": 4
80+
},
81+
"id": 3,
82+
"options": {
83+
"calculate": false,
84+
"cellGap": 1,
85+
"color": {
86+
"exponent": 0.5,
87+
"fill": "dark-orange",
88+
"mode": "scheme",
89+
"reverse": true,
90+
"scale": "exponential",
91+
"scheme": "Oranges",
92+
"steps": 64
93+
},
94+
"exemplars": {
95+
"color": "rgba(255,0,255,0.7)"
96+
},
97+
"filterValues": {
98+
"le": 1e-9
99+
},
100+
"legend": {
101+
"show": true
102+
},
103+
"rowsFrame": {
104+
"layout": "auto"
105+
},
106+
"tooltip": {
107+
"show": true,
108+
"yHistogram": false
109+
},
110+
"yAxis": {
111+
"axisPlacement": "left",
112+
"reverse": false
113+
}
114+
},
115+
"pluginVersion": "9.2.3",
116+
"targets": [
117+
{
118+
"datasource": {
119+
"type": "loki",
120+
"uid": "P00201832B18B88C3"
121+
},
122+
"editorMode": "builder",
123+
"expr": "sum(count_over_time({label=~\"T1219.*|recon|.*susp.*\", node=~\"$node\"} |= `$query` [$__interval]))",
124+
"queryType": "range",
125+
"refId": "A"
126+
}
127+
],
128+
"title": "Suspicious activity",
129+
"type": "heatmap"
130+
},
131+
{
132+
"datasource": {
133+
"type": "loki",
134+
"uid": "P00201832B18B88C3"
135+
},
136+
"description": "Filter for security auditlogs that that are potentially suspicious.",
137+
"gridPos": {
138+
"h": 17,
139+
"w": 24,
140+
"x": 0,
141+
"y": 10
142+
},
143+
"id": 1,
144+
"options": {
145+
"dedupStrategy": "none",
146+
"enableLogDetails": true,
147+
"prettifyLogMessage": false,
148+
"showCommonLabels": false,
149+
"showLabels": false,
150+
"showTime": true,
151+
"sortOrder": "Descending",
152+
"wrapLogMessage": true
153+
},
154+
"targets": [
155+
{
156+
"datasource": {
157+
"type": "loki",
158+
"uid": "P00201832B18B88C3"
159+
},
160+
"editorMode": "builder",
161+
"expr": "{job=\"auditlogs\", label=~\"T1219.*|recon|.*susp.*\", node=~\"$node\"} |= `$query`",
162+
"key": "Q-9181c263-cf75-42fe-bf50-036eeff7207a-0",
163+
"queryType": "range",
164+
"refId": "A"
165+
}
166+
],
167+
"title": "Suspicious activity",
168+
"type": "logs"
169+
},
170+
{
171+
"datasource": {
172+
"type": "loki",
173+
"uid": "P00201832B18B88C3"
174+
},
175+
"description": "All captured logs from auditd",
176+
"gridPos": {
177+
"h": 17,
178+
"w": 24,
179+
"x": 0,
180+
"y": 27
181+
},
182+
"id": 4,
183+
"options": {
184+
"dedupStrategy": "none",
185+
"enableLogDetails": true,
186+
"prettifyLogMessage": false,
187+
"showCommonLabels": false,
188+
"showLabels": false,
189+
"showTime": true,
190+
"sortOrder": "Descending",
191+
"wrapLogMessage": true
192+
},
193+
"targets": [
194+
{
195+
"datasource": {
196+
"type": "loki",
197+
"uid": "P00201832B18B88C3"
198+
},
199+
"editorMode": "builder",
200+
"expr": "{job=\"auditlogs\", node=~\"$node\"} |= `$query`",
201+
"key": "Q-9181c263-cf75-42fe-bf50-036eeff7207a-0",
202+
"queryType": "range",
203+
"refId": "A"
204+
}
205+
],
206+
"title": "All audit logs",
207+
"type": "logs"
208+
}
209+
],
210+
"refresh": false,
211+
"schemaVersion": 37,
212+
"style": "dark",
213+
"tags": [],
214+
"templating": {
215+
"list": [
216+
{
217+
"current": {
218+
"selected": false,
219+
"text": "",
220+
"value": ""
221+
},
222+
"hide": 0,
223+
"label": "Find",
224+
"name": "query",
225+
"options": [
226+
{
227+
"selected": true,
228+
"text": "",
229+
"value": ""
230+
}
231+
],
232+
"query": "",
233+
"skipUrlSync": false,
234+
"type": "textbox"
235+
},
236+
{
237+
"current": {
238+
"selected": true,
239+
"text": ["All"],
240+
"value": ["$__all"]
241+
},
242+
"datasource": {
243+
"type": "loki",
244+
"uid": "P00201832B18B88C3"
245+
},
246+
"definition": "",
247+
"hide": 0,
248+
"includeAll": true,
249+
"label": "Hostname",
250+
"multi": true,
251+
"name": "node",
252+
"options": [],
253+
"query": {
254+
"label": "node",
255+
"refId": "LokiVariableQueryEditor-VariableQuery",
256+
"stream": "",
257+
"type": 1
258+
},
259+
"refresh": 1,
260+
"regex": "",
261+
"skipUrlSync": false,
262+
"sort": 0,
263+
"type": "query"
264+
}
265+
]
266+
},
267+
"time": {
268+
"from": "now-15m",
269+
"to": "now"
270+
},
271+
"timepicker": {},
272+
"timezone": "",
273+
"title": "Audit logs",
274+
"uid": "1KG6epL4z",
275+
"version": 1,
276+
"weekStart": ""
277+
}

0 commit comments

Comments
 (0)