auditd ile /etc/passwd ve /etc/shadow Yazma Girişlerini Anlık Algılama ve Engelleme

In my environment, detecting unauthorized changes to /etc/passwd and /etc/shadow is non-negotiable for Linux server hardening. auditd provides kernel-level auditing that triggers immediately when these critical files are touched, giving you real-time visibility and response capability. I rely on it to catch credential tampering attempts before they lead to privilege escalation or account takeover.

First, ensure auditd is installed and running. On most modern distributions, it's already present, but verify:

sudo systemctl status auditd

If inactive, start and enable it:

sudo systemctl start auditd
sudo systemctl enable auditd

Next, define audit rules to monitor write, attribute change, and open-for-write operations on both files. I use the -w (watch) flag with p=wa to catch writes and attribute modifications:

sudo auditctl -w /etc/passwd -p wa -k passwd_watch
sudo auditctl -w /etc/shadow -p wa -k shadow_watch

The -k flag sets a filter key, making it easy to search logs later. These rules persist until reboot; to make them permanent, add them to /etc/audit/rules.d/audit.rules:

# /etc/passwd ve /etc/shadow yazma izleme
-w /etc/passwd -p wa -k passwd_watch
-w /etc/shadow -p wa -k shadow_watch

Then reload the rules:

sudo augenrules --load

To test, try editing /etc/passwd with vipw (which safely opens it for edit):

sudo vipw

Make a harmless change, save and exit. Then check the audit log:

sudo ausearch -k passwd_watch -i

You’ll see an entry like:

type=SYSCALL msg=audit(1717000000.123:456): arch=c000003e syscall=2 success=yes exit=3 a0=7fffd1234567 a1=800 a2=0 a3=0 items=1 ppid=1234 pid=5678 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="exe" exe="/usr/sbin/vipw" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="passwd_watch"

This confirms the rule triggered. For real-time alerting, I pipe auditd logs into a monitoring system or use auditd’s built-in execution capability. For example, to run a script when a shadow file write is detected:

sudo auditctl -w /etc/shadow -p wa -k shadow_watch -a always,exit -F arch=b64 -S openat -F a2&0xO_WRONLY -F a2&0xO_RDWR -k shadow_write_exec

Then define an action in /etc/audit/auditd.conf via admin_space_left_action or use a tool like auditd with systemd triggers. A simpler approach: monitor logs with journalctl -f and trigger alerts via systemd path units or a lightweight watcher script.

I’ve found that combining auditd with fail2ban-like automation adds strength. For instance, if three write attempts to /etc/shadow occur within 60 seconds from the same IP, temporarily block the user via iptables or nftables. This mirrors what I described in my earlier post on detecting suspicious sudo usage via syslog and LLM, but here we operate at the kernel audit layer — more reliable and harder to bypass.

One warning: excessive auditing can generate noise. Focus on -p wa (write and attribute) rather than -p rwx unless you need read tracking. Also, exclude known legitimate processes like backup agents or PAM modules if they trigger false positives. Use ausearch and aureport to tune:

sudo aureport -f -k passwd_watch

Finally, remember that auditd detects and alerts — it doesn’t block by default. Pair it with real-time response: a script that kills the offending process, disables the user account, or triggers a SIEM alert. In high-security zones, I’ve seen teams integrate auditd hooks with automated account lockdown via usermod -L or just-in-time access revocation.

For Linux systems guarding critical auth data, auditd isn’t optional — it’s the first line of defense against silent credential theft.

Cover image: West Virginia National Guard · PDM (Openverse / kamu malı) · https://www.flickr.com/photos/163885612@N02/55234262023