章 16. 安全事件稽查
前一頁 | 部 III. 系統管理 | 下一頁

## 章 16. 安全事件稽查

Written by Tom Rhodes and Robert Watson.

## 16.1. 概述

The FreeBSD operating system includes support for security event auditing. Event auditing supports reliable, fine-grained, and configurable logging of a variety of security-relevant system events, including logins, configuration changes, and file and network access. These log records can be invaluable for live system monitoring, intrusion detection, and postmortem analysis. FreeBSD implements Sun™'s published Basic Security Module (BSM) Application Programming Interface (API) and file format, and is interoperable with the Solaris™ and Mac OS® X audit implementations.

This chapter focuses on the installation and configuration of event auditing. It explains audit policies and provides an example audit configuration.

讀完這章，您將了解︰

- What event auditing is and how it works.

- How to configure event auditing on FreeBSD for users and processes.

- How to review the audit trail using the audit reduction and review tools.

在開始閱讀這章之前，您需要︰

- 了解 UNIX® 及 FreeBSD 基礎 (章 3, FreeBSD 基礎)。

- Be familiar with the basics of kernel configuration/compilation (章 8, 設定 FreeBSD 核心).

- Have some familiarity with security and how it pertains to FreeBSD (章 13, 安全性).

### 警告:

The audit facility has some known limitations. Not all security-relevant system events are auditable and some login mechanisms, such as Xorg-based display managers and third-party daemons, do not properly configure auditing for user login sessions.

The security event auditing facility is able to generate very detailed logs of system activity. On a busy system, trail file data can be very large when configured for high detail, exceeding gigabytes a week in some configurations. Administrators should take into account the disk space requirements associated with high volume audit configurations. For example, it may be desirable to dedicate a file system to `/var/audit` so that other file systems are not affected if the audit file system becomes full.

前一頁 | 上一層 | 下一頁
15.8. MAC 架構疑難排解 | 起始頁 | 16.2. 關鍵詞

本文及其他文件，可由此下載： ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/。

若有 FreeBSD 方面疑問，請先閱讀 FreeBSD 相關文件，如不能解決的話，再洽詢 <questions@FreeBSD.org>。
關於本文件的問題，請洽詢 <doc@FreeBSD.org>。