Enabling auditd for Remote SSH Command Tracking

This guide outlines how to install, configure, and verify auditd on Arch Linux to log every command executed over non-interactive and interactive SSH sessions.

---

1. Installation

$ sudo pacman -S --noconfirm audit
$ sudo systemctl enable --now auditd

Verify:

$ sudo systemctl status auditd

---

2. Configuration Rules

Create a dedicated audit rule file under /etc/audit/rules.d/ to record all execve system calls executed by non-system user accounts (auid >= 1000).

Create /etc/audit/rules.d/execve.rules:

$ sudo tee /etc/audit/rules.d/execve.rules > /dev/null << 'EOF'
# Delete all existing rules
-D

# Set buffer size
-b 8192

# Log command executions for human/login users (auid >= 1000)
-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands
EOF

---

3. Applying Rules

Merge and load rule definitions into the kernel using augenrules:

$ sudo augenrules --load

Verify active rules:

$ sudo auditctl -l

Expected output:

-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands

---

4. Kernel Audit Enforcement (Optional)

Ensure kernel-level auditing is enabled by default. If auditctl -s reports enabled 0, append audit=1 to your bootloader (GRUB / systemd-boot) kernel parameters.

Check current status:

$ sudo auditctl -s

---

5. Querying Command Logs

Inspect command executions recorded by auditd:

View formatted execution logs:

$ sudo ausearch -k remote_commands -i --format text

Search for commands executed by a specific user:

$ sudo ausearch -k remote_commands -ua luke -i

Stream real-time execution logs:

$ sudo tail -f /var/log/audit/audit.log | grep "type=EXECVE"

---

6. Log Rotation & Storage Management

Manage log storage limits and rotation behavior in /etc/audit/auditd.conf:

max_log_file = 50
max_log_file_action = ROTATE
num_logs = 10

Restart auditd after making configuration changes to auditd.conf:

$ sudo systemctl restart auditd