Skip to main content

Enabling auditd for Remote SSH Command Tracking

This guide outlines how to install, configure, and verify auditd on Arch Linux to log every command executed over non-interactive and interactive SSH sessions.

1. Installation

Install the auditd package:

$ sudo apt-getpacman update-S --noconfirm audit
$ sudo apt-getsystemctl installenable -y-now auditd
audispd-plugins

Verify:

Verify that the auditd service is running:

$ sudo systemctl status auditd

2. Configuration

 Rules

Create a dedicated audit rule file under /etc/audit/rules.d/ to trackrecord all execve system calls triggeredexecuted by non-system user accounts (auid >= 1000)1000).

Create /etc/audit/rules.d/execve.rules:rules:

$ sudo tee /etc/audit/rules.d/execve.rules > /dev/null << 'EOF'
First# rule: removeDelete all existing rules
-D

# Set buffer size -b 8192

# Log all command executions byfor human/login users (auid >= 1000) -a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands -a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands

Lock the audit configuration to prevent unauthorized modification until reboot (Optional) -e 2 EOF

3. Applying Rules

LoadMerge and load rule definitions into the newlykernel createdusing rule configuration:augenrules:

$ sudo augenrules --load

Verify thatactive the rule is active:rules:

$ sudo auditctl -l

Expected output:

-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands

4. Kernel Audit Enforcement (Optional)

4.Ensure kernel-level auditing is enabled by default. If auditctl -s reports enabled 0, append audit=1 to your bootloader (GRUB / systemd-boot) kernel parameters.

Check current status:

$ sudo auditctl -s

5. Querying Command Logs

ToInspect inspectcommand commandsexecutions executedrecorded by remote SSH sessions:auditd:

View all recorded executions formatted forexecution readability:

logs: 

$ sudo ausearch -k remote_commands -i --format text

Search for commands executed by a specific user:

$ sudo ausearch -k remote_commands -ua luke -i

Follow

audit

Stream logsreal-time inexecution reallogs:

time: 

$ sudo tail -f /var/log/audit/audit.log | grep "type=EXECVE"

5.

6. Log Rotation & Storage Management

AuditManage log storage limits and rotation settings are managedbehavior in /etc/audit/auditd.conf:conf:

max_log_file = 50
max_log_file_action = ROTATE
num_logs = 10

Restart auditd after making configuration changes to auditd.conf:

After modifying /etc/audit/auditd.conf, restart the service:

$ sudo servicesystemctl restart auditd
restart