Audit ubuntu

audit.sh

#!/bin/bash

# install
apt-get install auditd audispd-plugins

# show active rules
auditctl -l

# setting a watch on the file /etc/passwd 
# listens for permissions change
# [r]ead, [w]rite, [a]ttribute change, e[x]ecute
auditctl -a exit,always -F path=/etc/passwd -F perm=wa

# get results from audit
ausearch -f /etc/passwd

# get system architecture
ARCH=`uname -m`

# getting the actual action
# from the ausearch we note the `syscall` value
# now translate that number to the action
ausyscall $ARCH SYS_CALL_INT

# refresh rules
auditctl -R /etc/audit/audit.rules

# delete all rules
auditctl -D

# use lynis for automated auditing
git clone [email protected]:CISOfy/lynis.git .
./lynis audit system