back to labs
Auditd: Monitor Deletions and Tune the Log
MediumLinux Security25-35 minThe brief
Compliance needs two auditd changes on this host. First, add a persistent syscall rule that records file-deletion events under an assigned key. Second, tune one parameter in the audit daemon's own configuration (/etc/audit/auditd.conf) to the required value. Read /root/case/assignment.env for the deletion syscalls (SYSCALL_1, SYSCALL_2), the audit key (AUDIT_KEY), and the auditd.conf setting (CONF_KEY, CONF_VAL). Grading reads the durable rules files and auditd.conf, so what is written on disk is what matters.
What you'll do
- Add a persistent audit rule that records the assigned deletion syscalls under the assigned key
- Set the assigned parameter in /etc/audit/auditd.conf to the required value
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.