12.12. Monitoring user login times with Audit

Conditions préalables

• auditd is configured in accordance with the settings provided in Configuring auditd for a secure environment .

• Search the audit log for the USER_LOGIN message type:

  # ausearch -m USER_LOGIN -ts '12/02/2020' '18:00:00' -sv no
  time->Mon Nov 22 07:33:22 2021
  type=USER_LOGIN msg=audit(1637584402.416:92): pid=1939 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=10.37.128.108 terminal=ssh res=failed'

  • You can specify the date and time with the -ts option. If you do not use this option, ausearch provides results from today, and if you omit time, ausearch provides results from midnight.
  • You can use the -sv yes option to filter out successful login attempts and -sv no for unsuccessful login attempts.

• Pipe the raw output of the ausearch command into the aulast utility, which displays the output in a format similar to the output of the last command. For example:

  # ausearch --raw | aulast --stdin
  root     ssh          10.37.128.108    Mon Nov 22 07:33 - 07:33  (00:00)
  root     ssh          10.37.128.108    Mon Nov 22 07:33 - 07:33  (00:00)
  root     ssh          10.22.16.106     Mon Nov 22 07:40 - 07:40  (00:00)
  reboot   system boot  4.18.0-348.6.el8 Mon Nov 22 07:33

• Display the list of login events by using the aureport command with the --login -i options.

  # aureport --login -i
  
  Login Report
  ============================================
  # date time auid host term exe success event
  ============================================
  1. 11/16/2021 13:11:30 root 10.40.192.190 ssh /usr/sbin/sshd yes 6920
  2. 11/16/2021 13:11:31 root 10.40.192.190 ssh /usr/sbin/sshd yes 6925
  3. 11/16/2021 13:11:31 root 10.40.192.190 ssh /usr/sbin/sshd yes 6930
  4. 11/16/2021 13:11:31 root 10.40.192.190 ssh /usr/sbin/sshd yes 6935
  5. 11/16/2021 13:11:33 root 10.40.192.190 ssh /usr/sbin/sshd yes 6940
  6. 11/16/2021 13:11:33 root 10.40.192.190 /dev/pts/0 /usr/sbin/sshd yes 6945