audit rules

10-base-config.rules

# Linux Audit baseline
# Intended for current 64-bit Debian- and RHEL-family systemd servers.
# Loaded before policy rules to establish a clean audit subsystem state.

## Reset - start from a known ruleset.
-D

## Kernel audit queue - tolerate short bursts without silently losing events.
-b 8192
--backlog_wait_time 60000

## Failure mode - warn loudly, but do not panic the host.
-f 1

30-audit-baseline.rules

# Modern Linux Audit baseline
# Intended for current 64-bit Debian- and RHEL-family systemd servers.
# Add matching b32 syscall rules only where 32-bit userspace is intentionally supported.

## Audit subsystem - protect audit configuration and record human access to audit logs.
-a always,exit -F arch=b64 -F dir=/etc/audit/ -F perm=wa -F key=audit_config
-a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=audit_log_access


## Identity - record changes to local users, groups, passwords, and login defaults.
-a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F key=identity
-a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F key=identity
-a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F key=identity
-a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F key=identity
-a always,exit -F arch=b64 -F path=/etc/login.defs -F perm=wa -F key=identity


## PAM - record changes to authentication and account policy.
-a always,exit -F arch=b64 -F dir=/etc/pam.d/ -F perm=wa -F key=pam_config
-a always,exit -F arch=b64 -F dir=/etc/security/ -F perm=wa -F key=pam_config


## SSH - record changes to ssh client/server configuration and drop-ins.
-a always,exit -F arch=b64 -F dir=/etc/ssh/ -F perm=wa -F key=ssh_config


## sudo - record sudo policy changes and human execution of privilege-transition tools.
-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=sudo_config
-a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=sudo_config
-a always,exit -F arch=b64 -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privilege_escalation
-a always,exit -F arch=b64 -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privilege_escalation
-a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid>=1000 -F auid!=unset -F key=privilege_escalation


## Privileged execution - tie root commands back to the original human login identity.
-a always,exit -F arch=b64 -S execve,execveat -F euid=0 -F auid>=1000 -F auid!=unset -F key=human_root_exec

## Alternate identities - catch human sessions executing as non-root service/user accounts.
-a always,exit -F arch=b64 -S execve,execveat -F euid!=0 -F auid>=1000 -F auid!=unset -C euid!=auid -F key=human_alt_identity_exec


## Shell persistence - record changes to system-wide interactive shell startup files.
-a always,exit -F arch=b64 -F path=/etc/profile -F perm=wa -F key=shell_config
-a always,exit -F arch=b64 -F dir=/etc/profile.d/ -F perm=wa -F key=shell_config


## systemd - record administrator-created or modified units, timers, and overrides.
-a always,exit -F arch=b64 -F dir=/etc/systemd/system/ -F perm=wa -F key=systemd_config


## Host identity - record hostname/domain changes and persistent hostname configuration.
-a always,exit -F arch=b64 -S sethostname,setdomainname -F key=host_identity
-a always,exit -F arch=b64 -F path=/etc/hostname -F perm=wa -F key=host_identity
-a always,exit -F arch=b64 -F path=/etc/hosts -F perm=wa -F key=host_identity


## Time - record manual clock changes and timezone changes.
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime,clock_adjtime -F key=time_change
-a always,exit -F arch=b64 -F path=/etc/localtime -F perm=wa -F key=time_change


## Dynamic linker - record changes to system library search configuration.
-a always,exit -F arch=b64 -F path=/etc/ld.so.conf -F perm=wa -F key=library_config
-a always,exit -F arch=b64 -F dir=/etc/ld.so.conf.d/ -F perm=wa -F key=library_config


## Kernel parameters - record persistent sysctl configuration changes.
-a always,exit -F arch=b64 -F path=/etc/sysctl.conf -F perm=wa -F key=sysctl_config
-a always,exit -F arch=b64 -F dir=/etc/sysctl.d/ -F perm=wa -F key=sysctl_config


## Kernel modules - record persistent module policy and runtime module loading/unloading.
-a always,exit -F arch=b64 -F dir=/etc/modprobe.d/ -F perm=wa -F key=module_config
-a always,exit -F arch=b64 -F dir=/etc/modules-load.d/ -F perm=wa -F key=module_config
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -F key=kernel_module


## Mounts - record classic and modern mount namespace/filesystem mount operations.
-a always,exit -F arch=b64 -S mount,umount2,move_mount,open_tree,fsopen,fsmount,fspick,mount_setattr -F key=mount


## Special files - record creation of device nodes and other special filesystem objects.
-a always,exit -F arch=b64 -S mknod,mknodat -F key=special_file


## Kernel/power - record reboot and kexec operations.
-a always,exit -F arch=b64 -S reboot,kexec_load,kexec_file_load -F key=power


## Denied access - record human permission failures against system configuration.
-a always,exit -F arch=b64 -S open,openat,openat2,creat -F dir=/etc/ -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access_denied
-a always,exit -F arch=b64 -S open,openat,openat2,creat -F dir=/etc/ -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access_denied

50-apache-debian.rules

# Debian-family Apache rules; load only where apache2 is installed.

## Web server configuration - record changes to Apache configuration and enabled modules/sites.
-a always,exit -F arch=b64 -F dir=/etc/apache2/ -F perm=wa -F key=apache_config

50-cron-debian.rules

# Debian-family cron rules; load only where cron is installed.

## Cron configuration - record changes to system and user scheduled jobs.
-a always,exit -F arch=b64 -F path=/etc/crontab -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.d/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.daily/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.hourly/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.weekly/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.monthly/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/var/spool/cron/crontabs/ -F perm=wa -F key=scheduler

## crontab use - record human execution of the crontab administration tool.
-a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=scheduler_admin

50-cron-rhel.rules

# RHEL-family cron rules; load only where cronie is installed.

## Cron configuration - record changes to system and user scheduled jobs.
-a always,exit -F arch=b64 -F path=/etc/crontab -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.d/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.daily/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.hourly/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.weekly/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/etc/cron.monthly/ -F perm=wa -F key=scheduler
-a always,exit -F arch=b64 -F dir=/var/spool/cron/ -F perm=wa -F key=scheduler

## crontab use - record human execution of the crontab administration tool.
-a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=scheduler_admin

50-docker.rules

# Docker rules; load only where Docker Engine is installed.

## Docker administration - record human use of the root-equivalent Docker CLI.
-a always,exit -F arch=b64 -F path=/usr/bin/docker -F perm=x -F auid>=1000 -F auid!=unset -F key=docker_admin

## Docker daemon configuration - enable when /etc/docker exists on this host.
# -a always,exit -F arch=b64 -F dir=/etc/docker/ -F perm=wa -F key=docker_config

## Docker socket - optional and potentially noisy; catches alternate clients using the daemon API.
# -a always,exit -F arch=b64 -F path=/var/run/docker.sock -F perm=rw -F auid>=1000 -F auid!=unset -F key=docker_socket

50-firewalld.rules

# firewalld rules; load only where firewalld is installed and /etc/firewalld exists.

## Firewall policy - record persistent firewalld configuration changes.
-a always,exit -F arch=b64 -F dir=/etc/firewalld/ -F perm=wa -F key=firewall_config

## Firewall administration - record human use of firewall-cmd.
-a always,exit -F arch=b64 -F path=/usr/bin/firewall-cmd -F perm=x -F auid>=1000 -F auid!=unset -F key=firewall_admin

50-httpd-rhel.rules

# RHEL-family Apache rules; load only where httpd is installed.

## Web server configuration - record changes to httpd configuration and included files.
-a always,exit -F arch=b64 -F dir=/etc/httpd/ -F perm=wa -F key=httpd_config

50-networkmanager.rules

# NetworkManager rules; load only where NetworkManager is installed.

## Network configuration - record changes to system NetworkManager configuration and connection profiles.
-a always,exit -F arch=b64 -F dir=/etc/NetworkManager/ -F perm=wa -F key=network_config

## Network administration - record human use of nmcli.
-a always,exit -F arch=b64 -F path=/usr/bin/nmcli -F perm=x -F auid>=1000 -F auid!=unset -F key=network_admin

50-nftables.rules

# nftables rules; load only where nftables is installed and /etc/nftables.conf exists.

## Firewall policy - record changes to persistent nftables configuration.
-a always,exit -F arch=b64 -F path=/etc/nftables.conf -F perm=wa -F key=firewall_config

## Firewall administration - record human use of nft.
-a always,exit -F arch=b64 -F path=/usr/sbin/nft -F perm=x -F auid>=1000 -F auid!=unset -F key=firewall_admin

50-nginx.rules

# nginx rules; load only where nginx is installed and /etc/nginx exists.

## Web server configuration - record changes to nginx configuration and included files.
-a always,exit -F arch=b64 -F dir=/etc/nginx/ -F perm=wa -F key=nginx_config

50-podman.rules

# Podman rules; load only where Podman is installed.

## Container administration - record human execution of Podman.
-a always,exit -F arch=b64 -F path=/usr/bin/podman -F perm=x -F auid>=1000 -F auid!=unset -F key=podman_admin

## System container policy - enable when /etc/containers exists on this host.
# -a always,exit -F arch=b64 -F dir=/etc/containers/ -F perm=wa -F key=container_config

50-postfix.rules

# Postfix rules; load only where Postfix is installed and these paths exist.

## Mail configuration - record changes to Postfix configuration and aliases.
-a always,exit -F arch=b64 -F dir=/etc/postfix/ -F perm=wa -F key=postfix_config
-a always,exit -F arch=b64 -F path=/etc/aliases -F perm=wa -F key=postfix_config

50-postgresql-debian.rules

# Debian-family PostgreSQL rules; load only where /etc/postgresql exists.

## Database configuration - record changes to PostgreSQL cluster configuration.
-a always,exit -F arch=b64 -F dir=/etc/postgresql/ -F perm=wa -F key=postgresql_config

50-postgresql-rhel.rules

# RHEL-family PostgreSQL template; enable only paths that exist on this host.
# Distro packages commonly use /var/lib/pgsql/data; PGDG packages often use a versioned data directory.

## Database configuration - record changes to PostgreSQL authentication and server configuration.
# -a always,exit -F arch=b64 -F path=/var/lib/pgsql/data/postgresql.conf -F perm=wa -F key=postgresql_config
# -a always,exit -F arch=b64 -F path=/var/lib/pgsql/data/pg_hba.conf -F perm=wa -F key=postgresql_config
# -a always,exit -F arch=b64 -F path=/var/lib/pgsql/data/pg_ident.conf -F perm=wa -F key=postgresql_config

# PGDG example; substitute the installed major version before enabling.
# -a always,exit -F arch=b64 -F path=/var/lib/pgsql/16/data/postgresql.conf -F perm=wa -F key=postgresql_config
# -a always,exit -F arch=b64 -F path=/var/lib/pgsql/16/data/pg_hba.conf -F perm=wa -F key=postgresql_config
# -a always,exit -F arch=b64 -F path=/var/lib/pgsql/16/data/pg_ident.conf -F perm=wa -F key=postgresql_config

50-stunnel.rules

# stunnel rules; load only where stunnel is installed and /etc/stunnel exists.

## TLS tunnel configuration - record changes to stunnel configuration and local credentials.
-a always,exit -F arch=b64 -F dir=/etc/stunnel/ -F perm=wa -F key=stunnel_config

99-finalize.rules

# Audit policy finalization.
# Keep mutable during development; enable immutability on hardened production hosts.

-e 1

# Hardened production option:
# -e 2

README.md

Optional Linux Audit service rules

These files layer on top of audit-baseline.rules.

Only install a service rule when the referenced service and paths exist on the host. Audit path and directory rules are intentionally not made universal because Debian- and RHEL-family package layouts differ and some packages do not create optional configuration directories until they are configured.

The service files do not contain -D, buffer/failure settings, or -e; the baseline owns global audit policy initialization and finalization.

Recommended workflow:

sudo cp audit-baseline.rules /etc/audit/rules.d/10-local-baseline.rules
sudo cp 50-<service>.rules /etc/audit/rules.d/
sudo augenrules --check
sudo augenrules --load
sudo auditctl -l

Use only one distro-specific variant where both Debian and RHEL variants exist.

Rules that are commented out are intentionally opt-in because their paths may not exist or their event volume may be substantially higher.