Skip to content

Commit f9c6972

Browse files
TheNewCat777TheNewCat777
committed
add-on fixes for linux / privileged
1 parent 481c3b6 commit f9c6972

File tree

4 files changed

+208
-58
lines changed

4 files changed

+208
-58
lines changed

‎docs/auditor/10.8/addon/linux/overview.md‎

Lines changed: 104 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -6,38 +6,119 @@ sidebar_position: 120
66

77
# Linux Generic Syslog
88

9-
The add-on works in collaboration with Netwrix Auditor, supplying data about activity on your
10-
Linux-based devices. Aggregating data into a single audit trail simplifies analysis, makes activity
11-
monitoring more cost effective, and helps you keep tabs on your IT infrastructure.
9+
The add-on works in collaboration with Netwrix Auditor, supplying data about activity on your Linux-based devices. Aggregating data into a single audit trail simplifies analysis, makes activity monitoring more cost effective, and helps you keep tabs on your IT infrastructure.
1210

13-
Implemented as a service, this add-on facilitates the data transition from Linux-based systems to
14-
Netwrix Auditor. All you have to do is provide connection details and specify parsing rules.
11+
Implemented as a service, this add-on facilitates the data transition from Linux-based systems to Netwrix Auditor. All you have to do is provide connection details and specify parsing rules.
1512

1613
On a high level, the add-on works as follows:
1714

18-
**Step 1 –** The add-on listens to the specified UDP ports and captures designated Syslog messages.
15+
**Step 1** – The add-on listens to the specified UDP ports and captures designated Syslog messages.
1916

20-
**Step 2 –** Out of the box, messages from Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise
21-
Server 12, openSUSE42, and Ubuntu 16 are supported. For other distributions, deployment of the
22-
rsyslog package may be required. You can edit the add-on configuration to extend the captured
23-
message list.
17+
**Step 2** – Out of the box, messages from Red Hat Enterprise Linux 6, 7, 8, 9, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported. For other distributions, deployment of the rsyslog package may be required. You can edit the add-on configuration to extend the captured message list.
2418

25-
**Step 3 –** The add-on processes these events into Netwrix Auditor-compatible format (Activity
26-
Records). Each Activity Record contains the user account, action, time, and other details.
19+
**Step 3** – The add-on processes these events into Netwrix Auditor-compatible format (Activity Records). Each Activity Record contains the user account, action, time, and other details.
2720

28-
**Step 4 –** Using the Integration API, the add-on sends the activity records to the Netwrix Auditor
29-
Server, which writes them to the Long-Term Archive and the Audit Database.
21+
**Step 4** – Using the Integration API, the add-on sends the activity records to the Netwrix Auditor Server, which writes them to the Long-Term Archive and the Audit Database.
3022

31-
See the [Integration API](/docs/auditor/10.8/api/overview.md) topic for additional information on the structure
32-
of the Activity Record and the capabilities of the NIntegration API.
23+
See the [Integration API](/docs/auditor/10.8/api/overview.md) topic for additional information on the structure of the Activity Record and the capabilities of the Integration API.
3324

3425
## Prerequisites
3526

36-
Before running the add-on, ensure that all the necessary components and policies are configured as
37-
follows:
27+
Before running the add-on, ensure that all the necessary components and policies are configured as follows:
3828

39-
| On... | Ensure that... |
40-
| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
41-
| The Netwrix Auditor Server side | - The Audit Database settings are configured in Auditor Server. - The TCP **9699** port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Contributor role in Auditor. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product. |
42-
| The computer where the add-on will be installed | - The UDP 514 port is open for inbound connections. **CAUTION:** UPD 514 port can only be used by one service, otherwise the following error will occur: [ERROR] Error occurred when starting the syslog udp listener. Only one usage of each socket address (protocol/network address/port) is normally permitted - .Net Framework [3.5 SP1](http://www.microsoft.com/en-us/download/details.aspx?id=22), [4.0](https://www.microsoft.com/en-us/download/details.aspx?id=17851), [4.5](https://www.microsoft.com/en-us/download/details.aspx?id=30653), or [4.6](https://www.microsoft.com/en-us/download/details.aspx?id=48130) is installed. |
43-
| On the target syslog-based platform | Outbound UDP 514 port must be enabled. The **Syslog daemon** must be configured to redirect events. The procedure below explains how to configure redirection. **NOTE:** Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported out of the box. For other distributions, deployment of the rsyslog package may be required. - On Red Hat Enterprise Linux 7, perform the following steps: **Step 5 –** Open the **/ etc/ rsyslog.conf** file. **Step 6 –** Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where **name** is a FQDN, Net BIOSname or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_SyslogProtocol23Format` **Step 7 –** Launch the **RHEL console** and execute the following command: `service rsyslog restart` - On Ubuntu 16, perform the following steps: **Step 1 –** Navigate to the **/ etc/ rsyslog.d/ 50-default.conf** file. **Step 2 –** Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where **name** is a FQDN, Net BIOSname or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_SyslogProtocol23Format` **Step 3 –** Launch the **UBUNTU console** and execute the following command: `service rsyslog restart` |
29+
### The Netwrix Auditor Server side
30+
31+
- The Audit Database settings are configured in Auditor Server.
32+
- The TCP **9699** port (default Auditor Integration API port) is open for inbound connections.
33+
- The user retrieving data from the Audit Database is granted the Contributor role in Auditor. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product.
34+
- The UDP **514** port is open for inbound connections.
35+
36+
**CAUTION:** UDP 514 port can only be used by one service, otherwise the following error will occur:
37+
38+
```
39+
[ERROR] Error occurred when starting the syslog udp listener. Only one usage of each socket address (protocol/network address/port) is normally permitted
40+
```
41+
42+
- .NET Framework [4.7.2](https://www.microsoft.com/en-us/download/details.aspx?id=48130) is installed.
43+
44+
### On the target syslog-based platform
45+
46+
- Outbound UDP **514** port must be enabled.
47+
- The **Syslog daemon** must be configured to redirect events. The procedure below explains how to configure redirection.
48+
49+
**NOTE:** The deployment of the rsyslog package may be required.
50+
51+
#### Configuration for RHEL 6-8 Linux Server
52+
53+
**Step 1** – Ensure that rsyslog is installed. If not, install it using the following command:
54+
55+
```bash
56+
sudo yum install rsyslog
57+
```
58+
59+
**Step 2** – Open the `/etc/rsyslog.conf` file.
60+
61+
**Step 3** – Add the following line:
62+
63+
```
64+
auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format
65+
```
66+
67+
where **name** is a FQDN, NetBIOS name or IP address of the computer where Netwrix Auditor Server is installed.
68+
69+
For example:
70+
71+
```
72+
auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_SyslogProtocol23Format
73+
```
74+
75+
**Step 4** – Save the file and restart the rsyslog service:
76+
77+
```bash
78+
sudo service rsyslog restart
79+
```
80+
81+
To verify the service is running:
82+
83+
```bash
84+
sudo service rsyslog status
85+
```
86+
87+
#### Configuration for Ubuntu and RHEL 9+
88+
89+
**Step 1** – Ensure that rsyslog is installed. If not, install it using the appropriate command:
90+
91+
For Ubuntu/Debian:
92+
93+
```bash
94+
sudo apt-get update
95+
sudo apt-get install rsyslog
96+
```
97+
98+
For RHEL 9+:
99+
100+
```bash
101+
sudo dnf install rsyslog
102+
```
103+
104+
**Step 2** – Navigate to the `/etc/rsyslog.d/50-default.conf` file.
105+
106+
**Step 3** – Add the following line:
107+
108+
```
109+
auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format
110+
```
111+
112+
where **name** is a FQDN, NetBIOS name or IP address of the computer where Netwrix Auditor Server is installed.
113+
114+
For example:
115+
116+
```
117+
auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_SyslogProtocol23Format
118+
```
119+
120+
**Step 4** – Save the file and restart the rsyslog service:
121+
122+
```bash
123+
sudo systemctl restart rsyslog
124+
```

0 commit comments

Comments
 (0)