4.5.2. Audit Logging, OpenSCAP, and Secure Destruction

💡 First Principle: Audit logging answers the forensic question "what happened?" — not in real time, but after the fact. auditd writes tamper-evident kernel-level audit records for file access, system calls, user authentication, and privilege escalation. Unlike application logs (which a compromised application can suppress), kernel audit records cannot be suppressed by userspace processes.

auditd — Kernel Audit Framework:

systemctl status auditd
cat /etc/audit/audit.rules      # Static rules file
cat /etc/audit/rules.d/*.rules  # Modern drop-in rules

# auditctl — manage rules at runtime
auditctl -l                     # List active rules
auditctl -s                     # Show audit status
auditctl -w /etc/passwd -p wa -k passwd_watch     # Watch /etc/passwd for writes+attrs
auditctl -w /etc/sudoers -p rwa -k sudoers_watch  # Watch sudoers
auditctl -a always,exit -F arch=b64 -S execve -k all_execs  # Log all command executions
auditctl -D                     # Delete all rules (runtime)

# Persistent rules: /etc/audit/rules.d/audit.rules
# -w /etc/passwd -p wa -k passwd_changes
# -a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k home_access_failures

# Searching audit logs
ausearch -k passwd_changes       # By key
ausearch -m LOGIN                # Login events
ausearch -ui 1001                # Events by UID
ausearch -ts today               # Today's events
ausearch -ts 2024-01-01 -te 2024-01-02  # Date range

# Reports
aureport                        # Summary report
aureport --auth                 # Authentication events
aureport --failed               # Failed events only

OpenSCAP — Security Content Automation Protocol:

OpenSCAP automates security policy checking against standardized profiles (DISA STIG, CIS Benchmarks, PCI-DSS).

# Install
dnf install openscap-scanner scap-security-guide   # RHEL
apt install libopenscap8 ssg-debian                # Debian

# Scan
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results results.xml \
  --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# Results: HTML report shows pass/fail for each rule with remediation guidance

# Generate remediation script
oscap xccdf generate fix \
  --profile cis \
  --output remediation.sh \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

CIS Benchmarks: The Center for Internet Security publishes free hardening benchmarks for every major OS distribution. OpenSCAP includes CIS profiles that automate checking against these benchmarks.

Secure Data Destruction:

When decommissioning storage, data must be destroyed so it cannot be recovered:

# Overwrite with random data (multiple passes)
shred -vzu -n 3 /dev/sdb        # 3 passes of random data, then zeros, then unlink
shred -v sensitive_file.txt     # Overwrite a file (note: doesn't work on SSDs/journaling FS)

# badblocks write mode
badblocks -wsv /dev/sdb         # Write test pattern across entire device

# dd overwrite
dd if=/dev/urandom of=/dev/sdb bs=4M status=progress   # One pass random
dd if=/dev/zero of=/dev/sdb bs=4M status=progress      # Final zero pass

# Cryptographic destruction (for LUKS)
cryptsetup luksErase /dev/sdb   # Wipe LUKS key slots → data becomes permanently inaccessible

Cryptographic destruction is the fastest and most secure method for LUKS-encrypted disks: destroy the encryption keys, and the ciphertext is computationally impossible to decrypt — no matter how many passes an attacker writes over the raw disk, the original data cannot be recovered without the lost key.

Security Banners (review):

/etc/issue                      # Pre-login console banner
/etc/issue.net                  # Pre-login SSH banner (referenced in sshd_config: Banner /etc/issue.net)
/etc/motd                       # Post-login message of the day

⚠️ Exam Trap: shred is ineffective on SSDs and filesystems with journaling or copy-on-write (btrfs, XFS with journaling). The filesystem may write new data to different blocks, leaving the original data intact on the physical medium. For SSDs: use the manufacturer's secure erase command (hdparm --security-erase, nvme format), or use cryptographic destruction (LUKS key erasure).

Reflection Question: An OpenSCAP scan produces a report showing 47 failing rules. You want to automatically generate remediation steps for all failures. What oscap subcommand produces a remediation script, and where would you look for the SCAP content file on a RHEL system?