isilon audit setting ( syslog )

OneFS auditing은 데이터 손실, 사기, 부적절한 권한 부여, 발생해서는 안 될 접근 시도, 그리고 위험을 나타내는 다양한 이상 징후의 잠재적 원인을 감지할 수 있습니다. 이는 auditing에서 데이터 접근을 특정 사용자 ID와 연관시킬 때 특히 유용할 수 있습니다.

데이터 보안을 위해 OneFS는 클러스터의 특정 활동을 로깅하여 '관리 연속성(Chain of Custody)' auditing 기능을 제공합니다. 여기에는 OneFS 구성 변경 사항뿐만 아니라 HIPAA, SOX, FISMA, MPAA 등 규제 기관의 요구 사항에 따라 조직의 IT 보안 규정 준수에 필요한 NFS, SMB 및 HDFS 클라이언트 프로토콜 활동도 포함됩니다.

 

 

 

구성도

Onefs ver : 9.7.1.8

log server : Rocky linux 8.10

SMB user : Win 11

 

▶️ audit 구성 확인

기본적으로 비활성화 상태 입니다. ( isilon cluster )

Eevets :

# isi audit settings view
            Audit Failure: create_file, create_directory, open_file_write, open_file_read, close_file_unmodified, close_file_modified, delete_file, delete_directory, rename_file, rename_directory, set_security_file, set_security_directory
            Audit Success: create_file, create_directory, open_file_write, open_file_read, close_file_unmodified, close_file_modified, delete_file, delete_directory, rename_file, rename_directory, set_security_file, set_security_directory
      Syslog Audit Events: create_file, create_directory, open_file_write, open_file_read, close_file_unmodified, close_file_modified, delete_file, delete_directory, rename_file, rename_directory, set_security_file, set_security_directory
Syslog Forwarding Enabled: No

 

Global

# isi audit settings global view
     Protocol Auditing Enabled: No
                 Audited Zones: -
               CEE Server URIs: -
                      Hostname:
       Config Auditing Enabled: No
         Config Syslog Enabled: No
         Config Syslog Servers: -
     Config Syslog TLS Enabled: No
  Config Syslog Certificate ID:
       Protocol Syslog Servers: -
   Protocol Syslog TLS Enabled: No
Protocol Syslog Certificate ID:
         System Syslog Enabled: No
         System Syslog Servers: -
     System Syslog TLS Enabled: No
  System Syslog Certificate ID:
          Auto Purging Enabled: No
              Retention Period: 180
       System Auditing Enabled: No

 

▶️ audit setting 방법  ( isilon cluster )

syslog forwarding 활성화
# isi audit settings modify --syslog-forwarding-enabled=true

syslog forwarding 활성화 확인
# isi audit settings view
            Audit Failure: create_file, create_directory, open_file_write, open_file_read, close_file_unmodified, close_file_modified, delete_file, delete_directory, rename_file, rename_directory, set_security_file, set_security_directory
            Audit Success: create_file, create_directory, open_file_write, open_file_read, close_file_unmodified, close_file_modified, delete_file, delete_directory, rename_file, rename_directory, set_security_file, set_security_directory
      Syslog Audit Events: create_file, create_directory, open_file_write, open_file_read, close_file_unmodified, close_file_modified, delete_file, delete_directory, rename_file, rename_directory, set_security_file, set_security_directory
Syslog Forwarding Enabled: Yes


cluster 전체 auditing 구성 활성화
# isi audit settings global modify --config-auditing-enabled=true

protocol auditing 구성
# isi audit settings global modify --protocol-auditing-enabled=true

auditing 를 syslog 로 redirection 구성
# isi audit settings global modify --config-syslog-enabled=true

zone auditing evets 를 syslog 로 전달 활성화
# isi audit settings modify --syslog-forwarding-enabled=true

auditing zone 구성
# isi audit settings global modify --add-audited-zones=System

auditing log 자동 삭제 기능 구성
# isi audit settings global modify --auto-purging-enabled=true

auditing log 보관 주기 구성
# isi audit settings global modify --retention-period=250

auditing 구성 확인
# isi audit settings global view
     Protocol Auditing Enabled: Yes
                 Audited Zones: System
               CEE Server URIs: -
                      Hostname:
       Config Auditing Enabled: Yes
         Config Syslog Enabled: Yes
         Config Syslog Servers: -
     Config Syslog TLS Enabled: No
  Config Syslog Certificate ID:
       Protocol Syslog Servers: -
   Protocol Syslog TLS Enabled: No
Protocol Syslog Certificate ID:
         System Syslog Enabled: No
         System Syslog Servers: -
     System Syslog TLS Enabled: No
  System Syslog Certificate ID:
          Auto Purging Enabled: Yes
              Retention Period: 250
       System Auditing Enabled: No

 

▶️ protocol syslog redirection 구성

 

- isilon config

# isi audit settings global modify --config-syslog-servers=192.168.233.142
# isi audit settings global modify --protocol-syslog-servers=192.168.233.142

# isi audit settings global view
     Protocol Auditing Enabled: Yes
                 Audited Zones: System
               CEE Server URIs: -
                      Hostname:
       Config Auditing Enabled: Yes
         Config Syslog Enabled: Yes
         Config Syslog Servers: 192.168.233.142
     Config Syslog TLS Enabled: No
  Config Syslog Certificate ID:
       Protocol Syslog Servers: 192.168.233.142
   Protocol Syslog TLS Enabled: No
Protocol Syslog Certificate ID:
         System Syslog Enabled: No
         System Syslog Servers: -
     System Syslog TLS Enabled: No
  System Syslog Certificate ID:
          Auto Purging Enabled: Yes
              Retention Period: 250
       System Auditing Enabled: No

 

9.5.x.x 버전은 /etc/syslog.conf 에 하기와 같이 적용됩니다.

!audit_protocol
*.*                                             /var/log/audit_protocol.log
*.*                                             @192.168.233.142

 

 

- log server setting

rsyslog.conf 파일에 내용 추가

# vi /etc/rsyslog.conf

module(load="imudp") 
input(type="imudp" port="514")
module(load="imtcp") 
input(type="imtcp" port="514")

template(name="audit_protocol" type="string" string="/var/log/audit_protocol.log")

# *.* 로 지정하면 로컬 로그도 같이 쌓이므로 원격 로그만 쌓이도록 설정
if ($fromhost-ip != "127.0.0.1" and $fromhost-ip != "::1") then {
    *.* ?audit_protocol
}

저장후 rsyslog 데몬 재시작

# systemctl restart rsyslog

 

- log 확인