Question: How do I monitor security-related changes made to the file system on my EC2 Linux instance?

I want to enable the Linux Audit system to monitor changes to the file system on my Amazon Elastic Compute Cloud (Amazon EC2) instance. How can I do this?Short descriptionThe Linux Audit system tracks access to important files and creates an audit trail in case of file corruption or other unintended changes. You can use the Linux Audit system to track changes to files in Amazon Elastic File System (Amazon EFS) or any other file system type. Be aware that configuring the audit system to log many types of information might impact the local system performance. After installing the Linux Audit system on your system, you can create rules that monitor the activity on your file system.Important: To track all changes to your file system, enable the Linux Audit system on every client that mounts your file system.Resolution1.    Connect to your EC2 instance using SSH as ec2-user/ubuntu/root user. Replace ubuntu with the user name for your AMI.2.    Run the following command to install the audit package:RHEL and CentOS:# sudo yum install auditSUSE Linux:# sudo zypper install auditUbuntu:# sudo apt install auditd3.    Create rules for the Linux Audit system. For the purpose of testing rules initially, use the command auditctl to immediately add or remove rules.Note: The following examples show rules for an EFS file system.Use the following command to monitor all activity where your file system is mounted:$ auditctl -w /home/ec2-user/efs -k efs_changesThe following are examples of actions that you can configure the audit system to log:$ mkdir dir1$ touch file1$ touch file2$ mv file1 file3$ rm -f file2$ chmod 600 file3$ rmdir dir1$ rm -f file34.    Next, use the ausearch -k efs_changes command to view the audit log. The following example shows the audit log for the mkdir command shown in the preceding example operations:time->Thu Jan  9 21:30:59 2020type=PROCTITLE msg=audit(1578605459.080:127433): proctitle=6D6B6469720064697231type=PATH msg=audit(1578605459.080:127433): item=1 name="dir1" inode=4989235361872937641 dev=00:16 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0type=PATH msg=audit(1578605459.080:127433): item=0 name="/home/ec2-user/efs/audit" inode=12759736523397539955 dev=00:16    mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0type=CWD msg=audit(1578605459.080:127433): cwd="/home/ec2-user/efs/audit"type=SYSCALL msg=audit(1578605459.080:127433): arch=c000003e syscall=83 success=yes exit=0 a0=7fffe6aca6e1 a1=1ff a2=1ff a3=7fffe6ac7720 items=2 ppid=18661 pid=2948 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=18369 comm="mkdir" exe="/bin/mkdir"     key="efs_changes"The preceding example shows the raw audit log. The audit log contains a large amount of information for each operation.Use the aureport command to create a less verbose output in the audit log, but still show all of the operations:$ ausearch -k efs_changes | aureport -f -i10118. 01/09/2020 21:36:29 file1 open yes /bin/touch ec2-user 12745010119. 01/09/2020 21:36:29 dir1 mkdir yes /bin/mkdir ec2-user 12744910120. 01/09/2020 21:36:29 file2 open yes /bin/touch ec2-user 12745110121. 01/09/2020 21:36:29 file3 rename yes /bin/mv ec2-user 12745210122. 01/09/2020 21:36:29 file2 unlinkat yes /bin/rm ec2-user 12745310123. 01/09/2020 21:36:29 file3 fchmodat yes /bin/chmod ec2-user 12745410124. 01/09/2020 21:36:29 dir1 rmdir yes /bin/rmdir ec2-user 12745510125. 01/09/2020 21:36:35 file3 unlinkat yes /bin/rm ec2-user 127456Keep in mind that you don't have to log all operations. For example, you can create a rule to log only delete-related actions:auditctl -a always,exit -F arch=b64 -F dir=/home/ec2-user/efs -S unlink -S unlinkat -S rename -S renameat  -S rmdir -k efs_changesIf a user runs the same commands shown in the original example set of operations, only the specified delete-related commands appear in the log:10126. 01/09/2020 22:17:08 file3 rename yes /bin/mv ec2-user 12751910127. 01/09/2020 22:17:08 file2 unlinkat yes /bin/rm ec2-user 12752010128. 01/09/2020 22:17:08 dir1 rmdir yes /bin/rmdir ec2-user 12752110129. 01/09/2020 22:17:09 file3 unlinkat yes /bin/rm ec2-user 1275225.    To make the rules persistent, configure them in the /etc/audit/audit.rules file. For more information, see Defining persistent audit rules and controls in the /etc/audit/audit.rules file on the Red Hat Customer Portal.

Related informationSystem auditingCustomized file monitoring with Auditd (tutorial)