ログ監査の検討

ログサンプル

## RDPの接続
[20200309-23:03:23] [INFO ] Socket 12: AF_INET connection received from 117.160.141.46 port 51320
[20200309-23:04:44] [INFO ] connected client computer name: VJPF118-NAELQJN
[20200309-23:04:44] [INFO ] TLS connection established from 49.97.92.72 port 44339: TLSv1.2 with cipher **** 
## ここでログイン成功
[20200309-23:06:12] [INFO ] xrdp_wm_log_msg: login successful for display 10

監査プラン

TERM	件数
AF_INET connection received from	多い
connected client computer name	AF_INETより少ないが沢山
TLS connection established from	だんだん少ないけど
login successful	成功したログインのみ

ログ監査

swatchをインストール

# yum install swatch

swatchで /var/log/xrdp.log を監査する

swatchのスクリプト

/root/binbin/swatch.webarena.xrdp.sh

#
# Swatch for /var/log/xrdp.log on webarena (centos)
#   /lib/systemd/system/user_swatch_xrdp.service
#

## sudo command SAMPLE
#watchfor /sudo:/
#  mail=ID@YOUR.MAIL.DOMAIN,subject="xxxx.swatch:sudo command"
#  threshold track_by=/sudo:/,type=limit,count=1,seconds=300
# limit : 300秒の間に、1回を超えると,300秒経過まで無視

##
ignore   /from www.xxx.yyy.zzz.*/
##
watchfor /login successful/
  mail=ID@YOUR.MAIL.DOMAIN,subject="xrdp login successful"
    threshold track_by=/login successful/,type=limit,count=1,seconds=300

作成したswatchスクリプトをsystemdにサービス登録する

/usr/lib/systemd/system/user_swatch_xrdp.service

[Unit]
Description=xrdp-log Authentication
After=rsyslog.service

[Service]
ExecStart=/usr/bin/swatch -c /root/binbin/swatch.webarena.xrdp.sh -t /var/log/xrdp.log --daemon > /dev/null 2>&1
KillMode=process
Type=simple
Restart=no

[Install]
WantedBy=multi-user.target

systemdでサービス登録

# systemctl enable user_swatch_xrdp
# systemctl start  user_swatch_xrdp