Linux-Command-Log-Collector

Overview

This project helps in collecting logs of executed commands on a Linux system. The solution uses LD_PRELOAD to intercept command execution and auditd to track command execution events.

Prerequisites

Before you start, ensure you have the following tools installed on your system:

GCC Compiler
Audit Daemon (auditd)

Step-by-Step Setup

1. Compile the Logger

First, compile the shared library exec_logger.so from the source file exec_logger.c. This library will be used to intercept command executions.

gcc -shared -fPIC -o exec_logger.so exec_logger.c -ldl

2. Set Up LD_PRELOAD

Set up LD_PRELOAD to use the compiled library. This will ensure that the logger library is loaded before other libraries, allowing it to intercept command executions.

export LD_PRELOAD=/path/to/exec_logger.so

To make this change permanent, add it to your system profile:

echo 'export LD_PRELOAD=/path/to/exec_logger.so' | sudo tee -a /etc/profile

3. Install `auditd` and `audispd-plugins`

Update your package list and install auditd and its plugins:

sudo apt-get update
sudo apt-get install auditd audispd-plugins

4. Configure `auditd` Rules

To monitor command executions, you need to add audit rules. Open the audit rules file and add the following lines:

sudo nano /etc/audit/rules.d/audit.rules

Add these rules to the file:

-w /usr/bin/sudo -p x -k command_executions
-w /bin/ -p x -k command_executions
-w /usr/bin/ -p x -k command_executions
-w /usr/sbin/ -p x -k command_executions

These rules will track execution events for common command binaries and sudo.

5. Restart `auditd`

Finally, restart the auditd service to apply the new rules:

sudo service auditd restart

Verification

After completing the setup, you can test it by executing some commands and checking the logs:

# Execute some commands
ls
pwd

# Check the logs
sudo ausearch -sc execve

You should see entries related to the executed commands in the audit logs.

Troubleshooting

If you encounter issues with LD_PRELOAD, ensure the path to exec_logger.so is correct and that the file has the appropriate permissions.
Verify that auditd is running and that the audit rules are correctly applied by checking the status and rules with the following commands:
```
sudo service auditd status
sudo auditctl -l
```

Feel free to open an issue or submit a pull request if you encounter any problems or have suggestions for improvements.

emptyll / linux-command-log-collector Goto Github PK