Linux Audit Framework & File Integrity: `auditd`, AIDE & CIS Compliance

Created: 2026-11-10 Updated: 2026-11-10

Management Summary: Standard system loggers (syslog, journald) record exclusively what applications voluntarily emit via syslog APIs. An attacker with compromised root privileges can easily manipulate these logs, stop services, or wipe forensic traces without resistance. The Linux Audit Subsystem (auditd) operates directly inside the Linux kernel, intercepting system calls across unbypassable hook points: every file modification to sensitive configurations, every privilege escalation, and every binary execution is captured in a tamper-resistant audit trail. In combination with AIDE (Advanced Intrusion Detection Environment) for cryptographic file integrity monitoring (FIM) and Lynis for automated CIS compliance auditing, an airtight forensic defensive umbrella is established. This guide details the in-kernel audit architecture, immutable rules (-e 2), forensics via ausearch/aureport, AIDE baseline hashes, and systematic CIS benchmark audits.

Kernel Audit Architecture

How the Linux kernel intercepts system calls via hook points, streams events over Netlink sockets, and mitigates buffer overruns.
auditd Enterprise Rules

Monitoring critical paths (/etc/shadow, /etc/sudoers), syscall filtering, and locking down the configuration via the immutability flag -e 2.
Forensics with ausearch & aureport

Targeted forensic query evaluation by event key (-k), reconstructing human user sessions via auid, and generating management compliance reports.
File Integrity Monitoring (AIDE)

Cryptographic SHA256 baseline verification of system binaries (/bin/ls, /usr/sbin/sshd), early rootkit detection, and automated timer reports.
CIS Compliance Scans (Lynis)

Automated security audits conforming to CIS benchmarks, determining the Hardening Index, and systematic remediation across server fleets.
Performance & Incident Runbook

Buffer tuning (-b 8192) preventing audit loss, SIEM forwarding via audispd, and incident triage runbooks for compromised binaries.

1. Linux Auditing Architecture: The In-Kernel Audit Subsystem Data Stream

The Linux Audit Framework is not a userspace daemon parsing flat log files. It is an in-kernel subsystem tightly integrated into the kernel core, evaluated immediately before and after system calls:

%%{init: {'flowchart': {'wrappingWidth': 350}}}%%
flowchart TB
    Process["Userspace Process<br/>(execve, openat, chmod)"] ==> Kernel_Hooks["Kernel System-Call Hooks<br/>(Ring 0 Ingress Point)"]
    Kernel_Hooks --> Filter{"Audit Filter Evaluation<br/>(User / Task / Exit / Watch)"}
    Filter -->|"No Match"| Ignore["Syscall Ignored"]
    Filter -->|"Rule Triggered"| Netlink["Netlink Socket<br/>(NETLINK_AUDIT Buffer)"]
    Netlink --> Auditd_Daemon["auditd Daemon<br/>(/etc/audit/auditd.conf)"]
    Auditd_Daemon --> Disk_Log["Audit Trail on Disk<br/>(/var/log/audit/audit.log)"]
    Auditd_Daemon -.-> Audispd["audispd Dispatcher<br/>(Remote SIEM / Wazuh / ELK)"]

The Decisive Difference: Audit User ID (`auid`)

Inside the Linux kernel, every process maintains two separate user IDs: 1. uid: The current effective user ID (switches to 0 whenever sudo is executed). 2. auid (Login UID): The original user ID belonging to the real human user who initially authenticated into the system (e.g., UID 1000 for user nejat).

The auid is bound immutably to the process session by the kernel at login. Even if an adversary executes sudo su - or transitions across multiple nested shells: The audit subsystem logs every subsequent action tagged with the immutable original auid! This provides auditors and forensic investigators with undeniable attribution regarding which physical identity executed any administrative command.

2. Enterprise `auditd` Ruleset (`/etc/audit/rules.d/audit.rules`)

Audit rules are defined modularly in /etc/audit/rules.d/audit.rules and compiled into the running kernel via augenrules --load.

Complete Production Baseline Ruleset

Create /etc/audit/rules.d/audit.rules:

# /etc/audit/rules.d/audit.rules
# ==============================================================================
# Enterprise Linux Auditd Rules Baseline (CIS Benchmark Compliant)
# ==============================================================================

# 1. BUFFER & ERROR HANDLING POLICIES
# Flush existing kernel audit rules before loading new configuration
-D

# Increase kernel audit queue buffer to 8192 packets (prevents packet drops under load)
-b 8192

# Failure mode on buffer saturation: 1 = printk warning in kernel, 2 = kernel panic (high-assurance)
-f 1

# Rate limiting: 0 = unthrottled (ensures complete forensic fidelity)
-r 0

# 2. IDENTITY & AUTHENTICATION FILES (File Watches)
# Monitor changes to password databases, user groups, and PAM configuration
-w /etc/passwd -p wa -k identity_changes
-w /etc/shadow -p wa -k identity_changes
-w /etc/group -p wa -k identity_changes
-w /etc/gshadow -p wa -k identity_changes
-w /etc/security/opasswd -p wa -k identity_changes
-w /etc/pam.d/ -p wa -k pam_changes

# 3. PRIVILEGE ESCALATION & SUDOERS
-w /etc/sudoers -p wa -k priv_escalation
-w /etc/sudoers.d/ -p wa -k priv_escalation

# 4. NETWORK CONFIGURATION & SYSTEM BANNERS
-w /etc/issue -p wa -k system_banner
-w /etc/issue.net -p wa -k system_banner
-w /etc/hosts -p wa -k network_modifications
-w /etc/network/ -p wa -k network_modifications
-w /etc/ssh/sshd_config -p wa -k sshd_config_changes
-w /etc/ssh/sshd_config.d/ -p wa -k sshd_config_changes

# 5. SYSCALL MONITORING: EXECVE PRIVILEGE TRANSITIONS
# Log program executions where real UID differs from effective UID (setuid/setgid execution)
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k elevated_exec
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k elevated_exec

# 6. SYSTEM CALLS: PERMISSION & OWNERSHIP MODIFICATIONS (chmod, chown)
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod

# 7. KERNEL MODULE MANAGEMENT
# Monitor module insertion and removal (early detection of rootkit persistence)
-w /sbin/insmod -p x -k kernel_modules
-w /sbin/rmmod -p x -k kernel_modules
-w /sbin/modprobe -p x -k kernel_modules
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k kernel_modules

# 8. THE IMMUTABILITY LOCK FLAG (-e 2)
# Freezes the running audit configuration. No rules can be altered without a full system reboot!
-e 2

Compiling and Loading Rules

# Compile all fragments in /etc/audit/rules.d/ and atomically load them into the kernel
sudo augenrules --load

Caution Regarding Immutability Flag -e 2

The -e 2 directive at the end of the configuration freezes the kernel audit subsystem in place. From this moment onward, even the root superuser cannot alter or remove rules, nor stop the audit daemon. Any modifications require an administrative system reboot!

3. Forensic Log Analysis with `ausearch` & `aureport`

The audit trail in /var/log/audit/audit.log stores structured records optimized for machine ingestion. Human operators utilize two dedicated analysis utilities:

1. Targeted Forensic Analysis with `ausearch`

# Query all audit events associated with the "identity_changes" key
sudo ausearch -k identity_changes

# Determine who edited /etc/shadow (including automatic auid identity mapping)
sudo ausearch -f /etc/shadow -i

# Inspect failed authentication attempts across the preceding 24 hours
sudo ausearch -m USER_AUTH -sv no -ts yesterday

# List every elevated command executed by a specific user (auid 1000) under root
sudo ausearch -ua 1000 -k elevated_exec -i

Tip: The -i (interpret) flag automatically translates raw numeric identifiers (UIDs, syscall numbers, timestamps) into human-readable user names, syscall names, and localized dates!

2. Management & Compliance Reporting with `aureport`

# Generate high-level summary overview of all recorded events
sudo aureport --summary

# Generate login activity and terminal access report
sudo aureport -l

# Report all failed system call attempts (permission denials)
sudo aureport -s --failed -i

# Report on all executable binaries invoked
sudo aureport -x --summary

4. File Integrity Monitoring (FIM) with AIDE

While auditd captures system calls at runtime, AIDE (Advanced Intrusion Detection Environment) continuously validates the static integrity of filesystem trees on persistent storage.

When attackers successfully deploy rootkits, they frequently replace standard system binaries such as /bin/ls or /bin/ps with trojanized versions designed to hide rogue processes from administrators. AIDE exposes these covert modifications through cryptographic hashes (SHA256).

1. Installation and Configuration

# Install AIDE on Debian / Ubuntu
sudo apt-get install aide aide-common

Validation policies are defined in /etc/aide/aide.conf. For standard operational binaries, the NORMAL rule group applies (evaluating file size, permissions, inode numbers, hardlink counts, owner, group, and cryptographic SHA256 hashes).

2. Baseline Database Generation and Activation

# Generate the initial cryptographic baseline database (may take several minutes)
sudo aideinit

# Promote the newly generated database into active production state
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

3. Executing Manual Integrity Checks

# Compare current filesystem state against the active baseline
sudo aide --check

If AIDE produces output indicating modified files: Changed files: /usr/sbin/sshd the critical binary has been altered on disk!

4. Automated Integrity Audits via Systemd Timer

Enable the native systemd check timer for automated daily runs:

# Inspect status of the AIDE timer
sudo systemctl status aidecheck.timer

# Enable and start the timer for automated scheduled scans
sudo systemctl enable --now aidecheck.timer

5. Automated CIS Benchmark & Baseline Scans with Lynis

The Center for Internet Security (CIS) publishes internationally recognized security configuration benchmarks for Linux hosts. Lynis serves as the leading open-source compliance engine to audit hosts against these standards.

1. Installation and Executing System Scans

# Install Lynis package
sudo apt-get install lynis

# Execute a comprehensive unattended system security audit
sudo lynis audit system --quick

2. Evaluating the Hardening Index

Upon scan completion, Lynis computes an overall Hardening Index (scaled from 0 to 100). Default Linux server installations typically score between 55 and 65. Implementing the hardening suite documented across our security articles elevates this posture to > 85.

3. Extracting Warnings and Actionable Suggestions

# Display critical security warnings
sudo grep "WARNING" /var/log/lynis.log

# Extract prioritized hardening suggestions
sudo grep "SUGGESTION" /var/log/lynis.log

Each suggestion is linked to a deterministic test identifier (e.g., KRNL-5830). Administrators can retrieve detailed remediation guidance using lynis show details <Test-ID>.

6. Enterprise Best Practices & Incident Runbook

Refresh AIDE Baseline Following Legitimate Package Updates

Applying operating system updates via apt upgrade alters hundreds of system files. The subsequent AIDE run will flag hundreds of false positives.

Always re-baseline AIDE immediately following planned package upgrades:

sudo aide --update
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Incident Runbook: Alarm Triage Matrix

Alarm Signal	Suspected Root Cause	Triage Workflow
AIDE reports modified `/usr/sbin/sshd`	Rootkit injection or unauthorized package tampering	1. Immediately disconnect host network interface. 2. Execute `dpkg -V openssh-server` (verify Debian package integrity). 3. Execute `ausearch -f /usr/sbin/sshd -i` to isolate modifying process PID and responsible `auid`.
Auditd logs `backlog limit exceeded`	Kernel audit buffer undersized for burst I/O throughput	Increase audit buffer size in `/etc/audit/rules.d/audit.rules` to `-b 16384` and reload.
Lynis flags insecure permissions	Permissive file mode in `/etc/`	Restore strict ownership and permissions using `chmod 0600` on affected configuration files.

Integrating auditd, AIDE, and Lynis provides full-spectrum host defense: beyond proactive structural kernel hardening, the operating system possesses tamper-resistant forensic non-repudiation and automated CIS compliance governance at enterprise standard.

Linux Audit Framework & File Integrity: auditd, AIDE & CIS Compliance