* auditing audispd vs kubernetes daemonsets
@ 2020-04-10 20:39 Gabriel Alford
2020-04-13 13:57 ` Steve Grubb
0 siblings, 1 reply; 3+ messages in thread
From: Gabriel Alford @ 2020-04-10 20:39 UTC (permalink / raw)
To: linux-audit, Juan Osorio Robles
[-- Attachment #1.1: Type: text/plain, Size: 835 bytes --]
Hello,
In the midst of discussing sending audit logs from a Red Hat CoreOS node to
some central audit collection and evaluation tool, the question came up
about using audispd instead of Daemonsets. Daemonsets are what is planned
for OpenShift. As I understand it, the general principle is to allow
auditing to flow through the subsystem, but does it need to flow through
the entire auditing workflow? Can a Daemonset be used instead of audispd,
or are there reasons audispd should be used over a Daemonset that some of
us just aren't aware of?
Thanks,
Gabriel Alford
Member of the technical staff
office of the chief technologist
red hat Public Sector
Red Hat
<https://www.redhat.com>
ralford@redhat.com T: 972-707-6483 <650-254-4391> M: 303-550-7234
<https://red.ht/sig> <https://red.ht/sig>
[-- Attachment #1.2: Type: text/html, Size: 2744 bytes --]
[-- Attachment #2: Type: text/plain, Size: 102 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: auditing audispd vs kubernetes daemonsets
2020-04-10 20:39 auditing audispd vs kubernetes daemonsets Gabriel Alford
@ 2020-04-13 13:57 ` Steve Grubb
2020-04-13 16:00 ` Lenny Bruzenak
0 siblings, 1 reply; 3+ messages in thread
From: Steve Grubb @ 2020-04-13 13:57 UTC (permalink / raw)
To: linux-audit; +Cc: Gabriel Alford, Juan Osorio Robles
On Friday, April 10, 2020 4:39:37 PM EDT Gabriel Alford wrote:
> In the midst of discussing sending audit logs from a Red Hat CoreOS node to
> some central audit collection and evaluation tool, the question came up
> about using audispd instead of Daemonsets. Daemonsets are what is planned
> for OpenShift. As I understand it, the general principle is to allow
> auditing to flow through the subsystem, but does it need to flow through
> the entire auditing workflow?
I'd say that if you ask 10 people on this list, you may find 10 different ways
they are doing it. It really depends on your requirements. Some places care
that you don't mix security officer and system admin roles. (Security Officer may
have a system admin under investigation.) In that case, you have to keep the
logs separate and this is likely to a MLS system. Other, less demanding
sites, don't care because they are one in the same. They send audit logs into
syslog and then pick it apart later. And then there are some tools that have
their own audisp plugin and transport the logs themselves.
> Can a Daemonset be used instead of audispd, or are there reasons audispd
> should be used over a Daemonset that some of us just aren't aware of?
Entirely up to the system architect and their security requirements.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: auditing audispd vs kubernetes daemonsets
2020-04-13 13:57 ` Steve Grubb
@ 2020-04-13 16:00 ` Lenny Bruzenak
0 siblings, 0 replies; 3+ messages in thread
From: Lenny Bruzenak @ 2020-04-13 16:00 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 381 bytes --]
On 4/13/20 7:57 AM, Steve Grubb wrote:
>> Can a Daemonset be used instead of audispd, or are there reasons audispd
>> should be used over a Daemonset that some of us just aren't aware of?
> Entirely up to the system architect and their security requirements.
Will the Daemonset code be taken through Common Criteria evaluation?
LCB
--
Lenny Bruzenak
MagitekLTD
[-- Attachment #1.2: Type: text/html, Size: 892 bytes --]
[-- Attachment #2: Type: text/plain, Size: 102 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-04-13 16:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-10 20:39 auditing audispd vs kubernetes daemonsets Gabriel Alford
2020-04-13 13:57 ` Steve Grubb
2020-04-13 16:00 ` Lenny Bruzenak
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).