How to setup Auditd to monitor Apache/httpd for stop and restart.

Nemus · 09-10-2014, 07:42 PM

So I have a process restart on me in the middle of the night all I have is
[notice] SIGHUP received. Attempting to restart
Can I monitor httpd with auditd and see who or what is sending the SIGHUP?

Thanks

unSpawn · 09-11-2014, 01:18 AM

Asserting: the process sending the -HUP, one way or the other, has to possess root rights, you run a Linux distribution that uses RHEL-style SysV initscripts (here for the "killproc" function in /etc/rc.d/init.d/functions) and this is a one off where you manually or using a script manage rules with auditctl due to monitoring a (potentially changing Process Id), you'll want to monitor (for correlation purposes): 0) the PID file, the kill binary (see assertion #1) and 2 the Process Id of httpd. This might (more or less) look something like this:

Code:

auditctl -a always,exit -F path=/var/run/httpd.pid -F perm=r -F auid=0 -k rootkill
auditctl -a always,exit -F path=/bin/kill -F perm=x -F auid=0 -k rootkill
auditctl -a always,exit -S kill -F auid=0 -F pid=[mainpidofhttpdprocess] -k rootkill

Also check crontabs BTW.

Nemus · 09-11-2014, 02:01 PM

Quote:

Originally Posted by unSpawn

Asserting: the process sending the -HUP, one way or the other, has to possess root rights, you run a Linux distribution that uses RHEL-style SysV initscripts (here for the "killproc" function in /etc/rc.d/init.d/functions) and this is a one off where you manually or using a script manage rules with auditctl due to monitoring a (potentially changing Process Id), you'll want to monitor (for correlation purposes): 0) the PID file, the kill binary (see assertion #1) and 2 the Process Id of httpd. This might (more or less) look something like this:

Code:

auditctl -a always,exit -F path=/var/run/httpd.pid -F perm=r -F auid=0 -k rootkill
auditctl -a always,exit -F path=/bin/kill -F perm=x -F auid=0 -k rootkill
auditctl -a always,exit -S kill -F auid=0 -F pid=[mainpidofhttpdprocess] -k rootkill

Also check crontabs BTW.

So how would I search the audit logs for the SIGHUP?

unSpawn · 09-11-2014, 06:19 PM

Use 'grep rootkill' or see 'man ausearch'?