Section 8: administration and privileged commands
aulastlog – a program similar to lastlog Synopsis aulastlog [ options ] Description aulastlog is a program that prints out the last login for all users of the local machine similar to the way lastlog does. The login-name, port, and last login time will be printed. If the user has never logged in, the message…
aulast – a program similar to last Synopsis aulast [ options ] Description aulast is a program that prints out a listing of the last logged in users similarly to the program last and lastb. Aulast searches back through the audit logs or the given audit log file and displays a list of all users…
augenrules – a script that merges component audit rule files Synopsis augenrules [–check] [–load] Description augenrules is a script that merges all component audit rules files, found in the audit rules directory, /etc/audit/rules.d, placing the merged file in /etc/audit/audit.rules. Component audit rule files, must end in .rules in order to be processed. All other files in…
auditd_selinux – Security Enhanced Linux Policy for the auditd processes Description Security-Enhanced Linux secures the auditd processes via flexible mandatory access control. The auditd processes execute with the auditd_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
auditd – The Linux Audit daemon Synopsis auditd [-f] [-l] [-n] [-s disable|enable|nochange] Description auditd is the userspace component to the Linux Auditing System. It’s responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities. Configuring the audit system or loading rules is done with the auditctl utility. During…
auditctl_selinux – Security Enhanced Linux Policy for the auditctl processes Description Security-Enhanced Linux secures the auditctl processes via flexible mandatory access control. The auditctl processes execute with the auditctl_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
auditctl – a utility to assist controlling the kernel’s audit system Synopsis auditctl [options] Description The auditctl program is used to configure kernel options related to auditing, to see status of the configuration, and to load discretionary audit rules. Configuration Options -b backlog Set max number of outstanding audit buffers allowed (Kernel Default=64) If all buffers…
auditadm_sudo_selinux – Security Enhanced Linux Policy for the auditadm_sudo processes Description Security-Enhanced Linux secures the auditadm_sudo processes via flexible mandatory access control. The auditadm_sudo processes execute with the auditadm_sudo_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
auditadm_su_selinux – Security Enhanced Linux Policy for the auditadm_su processes Description Security-Enhanced Linux secures the auditadm_su processes via flexible mandatory access control. The auditadm_su processes execute with the auditadm_su_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
auditadm_r – Audit administrator role – Security Enhanced Linux Policy Description SELinux supports Roles Based Access Control (RBAC), some Linux roles are login roles, while other roles need to be transition into. Note: Examples in this man page will use the staff_u SELinux user. Non login roles are usually used for administrative tasks. For example,…
auditadm_screen_selinux – Security Enhanced Linux Policy for the auditadm_screen processes Description Security-Enhanced Linux secures the auditadm_screen processes via flexible mandatory access control. The auditadm_screen processes execute with the auditadm_screen_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
audit-viewer – A graphical utility for viewing and summarizing audit events Synopsis audit-viewer [–unprivileged] SAVED… Description audit-viewer is a GUI for viewing and summarizing audit events. Tabs displaying specific configuration can be specified on the command line using one or more SAVED file names, each file should contain either a previously saved window layout or…
audispd – an event multiplexor Synopsis audispd Description audispd is an audit event multiplexor. It has to be started by the audit daemon in order to get events. It takes audit events and distributes them to child programs that want to analyze events in realtime. When the audit daemon receives a SIGTERM or SIGHUP, it…
audispd-zos-remote – z/OS Remote-services Audit dispatcher plugin Synopsis audispd-zos-remote [ config-file ] Description audispd-zos-remote is a remote-auditing plugin for the Audit subsystem. It should be started by the audispd(8) daemon and will forward all incoming audit events, as they happen, to a configured z/OS SMF (Service Management Facility) database, through an IBM Tivoli Directory Server…
audisp_selinux – Security Enhanced Linux Policy for the audisp processes Description Security-Enhanced Linux secures the audisp processes via flexible mandatory access control. The audisp processes execute with the audisp_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
audisp_remote_selinux – Security Enhanced Linux Policy for the audisp_remote processes Description Security-Enhanced Linux secures the audisp_remote processes via flexible mandatory access control. The audisp_remote processes execute with the audisp_remote_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
audisp-remote – plugin for remote logging Synopsis audisp-remote Description audisp-remote is a plugin for the audit event dispatcher daemon, audispd, that preforms remote logging to an aggregate logging server. Tips If you are aggregating multiple machines, you should enable node information and enriched events in the audit event stream. You can do this in one…
audisp-prelude – plugin for IDMEF alerts Synopsis audisp-prelude [ –test ] Description audisp-prelude is a plugin for the audit event dispatcher daemon, audispd, that uses libprelude to send IDMEF alerts for possible Intrusion Detection events. This plugin requires connecting to a prelude-manager to record the events it sends. This plugin will analyze audit events in…
Pacemaker – Part of the Pacemaker cluster resource manager Synopsis attrd_updater command -n attribute [options] Description attrd_updater – Tool for updating cluster node attributes Options -?, –help This text -$, –version Version information -V, –verbose Increase debug output -n, –name=value The attribute’s name Commands: -U, –update=value Update the attribute’s value in attrd. If this causes…
atrun – run jobs queued for later execution Synopsis atrun [-l load_avg] [-d] Description atrun runs jobs queued by at(1). It is a shell script invoking /usr/sbin/atd with the -s option, and is provided for backward compatibility with older installations. See Also at(1), atd(8). Author At was mostly written by Thomas Koenig, ig25 [at] rz.uni-karlsruhe.de.