Enabling auditd for Remote SSH Command Tracking

This guide outlines how to install, configure, and verify auditd on Linux to log every command executed over non-interactive and interactive SSH sessions.

---

1. Installation

Install the auditd package:

$ sudo apt-get update $ sudo apt-get install -y auditd audispd-plugins

Verify that the auditd service is running:

$ sudo systemctl status auditd

---

2. Configuration

Create a dedicated audit rule file to track all execve system calls triggered by non-system user accounts (auid >= 1000).

Create /etc/audit/rules.d/execve.rules:

$ sudo tee /etc/audit/rules.d/execve.rules > /dev/null << 'EOF' First rule: remove all existing rules -D

Set buffer size -b 8192

Log all command executions by human/login users (auid >= 1000) -a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands -a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands

Lock the audit configuration to prevent unauthorized modification until reboot (Optional) -e 2 EOF

---

3. Applying Rules

Load the newly created rule configuration:

$ sudo augenrules --load

Verify that the rule is active:

$ sudo auditctl -l

Expected output:

-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands -a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands

---

4. Querying Command Logs

To inspect commands executed by remote SSH sessions:

View all recorded executions formatted for readability:

$ sudo ausearch -k remote_commands -i --format text

Search for commands executed by a specific user:

$ sudo ausearch -k remote_commands -ua luke -i

Follow audit logs in real time:

$ sudo tail -f /var/log/audit/audit.log | grep "type=EXECVE"

---

5. Log Rotation & Storage Management

Audit log rotation settings are managed in /etc/audit/auditd.conf:

max_log_file = 50 max_log_file_action = ROTATE num_logs = 10

After modifying /etc/audit/auditd.conf, restart the service:

$ sudo service auditd restart