Security Notice

Versions prior to 0.3.1 contained a serious bug which could cause audit rules to be silently ignored. Please see this advisory.

auditd

This module installs and configures auditd. It also provides a defined type(auditd::rule) to set up auditd rules.

Example usage

Include with default parameters and add a rule:

include auditd
auditd::rule { 'use-of-auditctl':
  content => '-w /sbin/auditctl -p x -k audittools',
  order   => '66',
}

License

See LICENSE file.

2015-11-19 Release 0.4.0

• No longer apply a default set of rules. Users will have to supply their own using the auditd::rule defined type.
• Provide an example set of rules.
• Add a security advisory about versions before 0.3.1 to the README

2015-11-19 Release 0.3.1

• Ensure rules loaded correctly with auditctl < 2.2
• Ensure rules loaded correctly when /etc/puppet does not exist

2014-11-24 Release 0.3.0 - various fixes by https://github.com/jpds

• Watch apparmor config
• Watch access to /home by admins
• Watch ipsec config
• Watch strongswan config
• Watch modules loading and unloading
• Watch files and execution in /tmp
• Watch timezone changes
• Entry rules deprecated in favour of exit rules
• Removed /data from default watch list

2014-5-20 Release 0.2.0

• Support versions of Ubuntu greater than 12.04

2014-02-25 Release 0.1.1

• add a Changelog entry for 0.1.0 release.

2014-02-25 Release 0.1.0

• Add the ability to drop configuration fragments.
• Make auditd.conf a configurable template.
• feature flag immutabality (default true)
• feature flag panicing on auditd rule failure (default false)

2013-08-15 Release 0.0.1

• Initial release