Skip to content

Instantly share code, notes, and snippets.

@benfgit

benfgit/install_auditd.sh

Last active October 24, 2025 13:21
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save benfgit/b068bab194fb25a2af48b1a0c28f4034 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save benfgit/b068bab194fb25a2af48b1a0c28f4034 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
install_auditd.sh
sudo apt update && sudo apt install auditd -y
sudo auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -F key=root_cmd
sudo auditctl -a always,exit -F arch=b32 -S execve -F euid=0 -F key=root_cmd
# Make rules persistent by adding them to the audit configuration
echo "-a always,exit -F arch=b64 -S execve -F euid=0 -F key=root_cmd" | sudo tee /etc/audit/rules.d/root_cmd.rules
echo "-a always,exit -F arch=b32 -S execve -F euid=0 -F key=root_cmd" | sudo tee -a /etc/audit/rules.d/root_cmd.rules
sudo systemctl restart auditd
sudo systemctl enable auditd
sudo auditctl -l
sudo cat /etc/audit/rules.d/root_cmd.rules
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment