* commands in hex vs ASCII
@ 2016-10-04 13:46 Kevin Brown
2016-10-04 14:00 ` Steve Grubb
0 siblings, 1 reply; 6+ messages in thread
From: Kevin Brown @ 2016-10-04 13:46 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 329 bytes --]
Hello,
Is there an option within auditd to set whether commands are stored as hex
vs ASCII?
With the prevalence of SIEM these days, seems easier to keep the commands
as ASCII and not presume a person needs to have access to a local system to
run ausearch.
Have gone through the documentation but didn't see an answer.
Thanks
[-- Attachment #1.2: Type: text/html, Size: 451 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: commands in hex vs ASCII
2016-10-04 13:46 commands in hex vs ASCII Kevin Brown
@ 2016-10-04 14:00 ` Steve Grubb
2016-10-04 14:11 ` William Roberts
0 siblings, 1 reply; 6+ messages in thread
From: Steve Grubb @ 2016-10-04 14:00 UTC (permalink / raw)
To: linux-audit; +Cc: Kevin Brown
Hello,
On Tuesday, October 4, 2016 9:46:32 AM EDT Kevin Brown wrote:
> Is there an option within auditd to set whether commands are stored as hex
> vs ASCII?
No.
> With the prevalence of SIEM these days, seems easier to keep the commands
> as ASCII and not presume a person needs to have access to a local system to
> run ausearch.
>
> Have gone through the documentation but didn't see an answer.
This is a design decision from way back around 2005. The problem is that a
user can control certain things. If they want to evade detection or throw off
naive analysis, then the can do log injection attacks by using spaces, legal
field names, and carriage returns in fields controlled by the user. Simple
parsers will be tricked.
There is some work currently going on wrt formatting output differently. In a
way I'd rather see some plugins created using libauparse that presents the
information to the siem in a format that it won't naively parse.
-Steve
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: commands in hex vs ASCII
2016-10-04 14:00 ` Steve Grubb
@ 2016-10-04 14:11 ` William Roberts
2016-10-04 14:13 ` Kevin Brown
0 siblings, 1 reply; 6+ messages in thread
From: William Roberts @ 2016-10-04 14:11 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit, Kevin Brown
You don't always need local access, I look at a lot of logs from systems I don't
have access too, and I just decode them using python. I use the snippet
from here to do it:
http://stackoverflow.com/questions/9641440/convert-from-ascii-string-encoded-in-hex-to-plain-ascii
It might not be ideal, I have simple needs. IIUC, ausearch also takes
input from stdin, so you
could cat raw log data you collected and use it on the other machine.
I have some vague
recollection of doing this years ago for Android, and it all worked as
advertised.
On Tue, Oct 4, 2016 at 10:00 AM, Steve Grubb <sgrubb@redhat.com> wrote:
> Hello,
>
> On Tuesday, October 4, 2016 9:46:32 AM EDT Kevin Brown wrote:
>> Is there an option within auditd to set whether commands are stored as hex
>> vs ASCII?
>
> No.
>
>> With the prevalence of SIEM these days, seems easier to keep the commands
>> as ASCII and not presume a person needs to have access to a local system to
>> run ausearch.
>>
>> Have gone through the documentation but didn't see an answer.
>
> This is a design decision from way back around 2005. The problem is that a
> user can control certain things. If they want to evade detection or throw off
> naive analysis, then the can do log injection attacks by using spaces, legal
> field names, and carriage returns in fields controlled by the user. Simple
> parsers will be tricked.
>
> There is some work currently going on wrt formatting output differently. In a
> way I'd rather see some plugins created using libauparse that presents the
> information to the siem in a format that it won't naively parse.
>
> -Steve
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
--
Respectfully,
William C Roberts
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: commands in hex vs ASCII
2016-10-04 14:11 ` William Roberts
@ 2016-10-04 14:13 ` Kevin Brown
2016-10-04 21:16 ` Burn Alting
0 siblings, 1 reply; 6+ messages in thread
From: Kevin Brown @ 2016-10-04 14:13 UTC (permalink / raw)
To: William Roberts; +Cc: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 2028 bytes --]
Thanks for the responses so far
On Tuesday, October 4, 2016, William Roberts <bill.c.roberts@gmail.com>
wrote:
> You don't always need local access, I look at a lot of logs from systems I
> don't
> have access too, and I just decode them using python. I use the snippet
> from here to do it:
> http://stackoverflow.com/questions/9641440/convert-
> from-ascii-string-encoded-in-hex-to-plain-ascii
>
> It might not be ideal, I have simple needs. IIUC, ausearch also takes
> input from stdin, so you
> could cat raw log data you collected and use it on the other machine.
> I have some vague
> recollection of doing this years ago for Android, and it all worked as
> advertised.
>
>
>
> On Tue, Oct 4, 2016 at 10:00 AM, Steve Grubb <sgrubb@redhat.com
> <javascript:;>> wrote:
> > Hello,
> >
> > On Tuesday, October 4, 2016 9:46:32 AM EDT Kevin Brown wrote:
> >> Is there an option within auditd to set whether commands are stored as
> hex
> >> vs ASCII?
> >
> > No.
> >
> >> With the prevalence of SIEM these days, seems easier to keep the
> commands
> >> as ASCII and not presume a person needs to have access to a local
> system to
> >> run ausearch.
> >>
> >> Have gone through the documentation but didn't see an answer.
> >
> > This is a design decision from way back around 2005. The problem is that
> a
> > user can control certain things. If they want to evade detection or
> throw off
> > naive analysis, then the can do log injection attacks by using spaces,
> legal
> > field names, and carriage returns in fields controlled by the user.
> Simple
> > parsers will be tricked.
> >
> > There is some work currently going on wrt formatting output differently.
> In a
> > way I'd rather see some plugins created using libauparse that presents
> the
> > information to the siem in a format that it won't naively parse.
> >
> > -Steve
> >
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com <javascript:;>
> > https://www.redhat.com/mailman/listinfo/linux-audit
>
>
>
> --
> Respectfully,
>
> William C Roberts
>
[-- Attachment #1.2: Type: text/html, Size: 2869 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: commands in hex vs ASCII
2016-10-04 14:13 ` Kevin Brown
@ 2016-10-04 21:16 ` Burn Alting
2016-10-04 21:59 ` F Rafi
0 siblings, 1 reply; 6+ messages in thread
From: Burn Alting @ 2016-10-04 21:16 UTC (permalink / raw)
To: Kevin Brown; +Cc: linux-audit
Kevin,
Have you thought of locally processing the logs using ausearch -i (which
does the conversion you want) and then transmitting the locally
interpreted logs to your SIEM?
On Tue, 2016-10-04 at 10:13 -0400, Kevin Brown wrote:
> Thanks for the responses so far
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: commands in hex vs ASCII
2016-10-04 21:16 ` Burn Alting
@ 2016-10-04 21:59 ` F Rafi
0 siblings, 0 replies; 6+ messages in thread
From: F Rafi @ 2016-10-04 21:59 UTC (permalink / raw)
To: burn; +Cc: linux-audit, Kevin Brown
[-- Attachment #1.1: Type: text/plain, Size: 650 bytes --]
We're using the hex to ascii function in our hosted log aggregation
solution. It's something that we had to open a feature request for
initially but, it works well.
-Farhan
On Tue, Oct 4, 2016 at 5:16 PM, Burn Alting <burn@swtf.dyndns.org> wrote:
> Kevin,
>
> Have you thought of locally processing the logs using ausearch -i (which
> does the conversion you want) and then transmitting the locally
> interpreted logs to your SIEM?
>
> On Tue, 2016-10-04 at 10:13 -0400, Kevin Brown wrote:
> > Thanks for the responses so far
> >
>
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
[-- Attachment #1.2: Type: text/html, Size: 1257 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-10-04 22:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-10-04 13:46 commands in hex vs ASCII Kevin Brown
2016-10-04 14:00 ` Steve Grubb
2016-10-04 14:11 ` William Roberts
2016-10-04 14:13 ` Kevin Brown
2016-10-04 21:16 ` Burn Alting
2016-10-04 21:59 ` F Rafi
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.