auditing audispd vs kubernetes daemonsets

auditing audispd vs kubernetes daemonsets

[Gabriel Alford]

[-- Attachment #1.1: Type: text/plain, Size: 835 bytes --]

Hello,

In the midst of discussing sending audit logs from a Red Hat CoreOS node to
some central audit collection and evaluation tool, the question came up
about using audispd instead of Daemonsets. Daemonsets are what is planned
for OpenShift. As I understand it, the general principle is to allow
auditing to flow through the subsystem, but does it need to flow through
the entire auditing workflow? Can a Daemonset be used instead of audispd,
or are there reasons audispd should be used over a Daemonset that some of
us just aren't aware of?

Thanks,

Gabriel Alford

Member of the technical staff

office of the chief technologist

red hat Public Sector

Red Hat

<https://www.redhat.com>

ralford@redhat.com    T: 972-707-6483 <650-254-4391>    M: 303-550-7234
<https://red.ht/sig> <https://red.ht/sig>

[-- Attachment #1.2: Type: text/html, Size: 2744 bytes --]

[-- Attachment #2: Type: text/plain, Size: 102 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Re: auditing audispd vs kubernetes daemonsets

[Steve Grubb]

On Friday, April 10, 2020 4:39:37 PM EDT Gabriel Alford wrote:
> In the midst of discussing sending audit logs from a Red Hat CoreOS node to
> some central audit collection and evaluation tool, the question came up
> about using audispd instead of Daemonsets. Daemonsets are what is planned
> for OpenShift. As I understand it, the general principle is to allow
> auditing to flow through the subsystem, but does it need to flow through
> the entire auditing workflow? 

I'd say that if you ask 10 people on this list, you may find 10 different ways 
they are doing it. It really depends on your requirements. Some places care 
that you don't mix security officer and system admin roles. (Security Officer may 
have a system admin under investigation.) In that case, you have to keep the 
logs separate and this is likely to a MLS system. Other, less demanding 
sites, don't care because they are one in the same. They send audit logs into 
syslog and then pick it apart later. And then there are some tools that have 
their own audisp plugin and transport the logs themselves.

> Can a Daemonset be used instead of audispd, or are there reasons audispd
> should be used over a Daemonset that some of us just aren't aware of?

Entirely up to the system architect and their security requirements.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Re: auditing audispd vs kubernetes daemonsets

[Lenny Bruzenak]

[-- Attachment #1.1: Type: text/plain, Size: 381 bytes --]

On 4/13/20 7:57 AM, Steve Grubb wrote:

>> Can a Daemonset be used instead of audispd, or are there reasons audispd
>> should be used over a Daemonset that some of us just aren't aware of?
> Entirely up to the system architect and their security requirements.

Will the Daemonset code be taken through Common Criteria evaluation?

LCB

-- 
Lenny Bruzenak
MagitekLTD


[-- Attachment #1.2: Type: text/html, Size: 892 bytes --]

[-- Attachment #2: Type: text/plain, Size: 102 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit