auditd Archives - ITFROMZERO - Share tobe shared!

Mastering Linux Audit System (auditd) on Fedora: Monitor Sensitive Files and Track User Activity to Security Standards

By IT From Zero November 9, 2026

A practical guide to configuring the Linux Audit System (auditd) on Fedora to monitor sensitive files like /etc/passwd and /etc/sudoers, and track user sudo commands. Covers writing persistent rules, analyzing logs with ausearch/aureport, and lessons learned from six months of production use.

Ubuntu

Installing and Configuring Auditd on Ubuntu Server: Tracing User Actions Down to the Kernel Level

By IT From Zero October 23, 2026

Server config tampered with but bash_history is empty? Learn how to configure Auditd on Ubuntu to trace all actions and unmask real user identities at the Linux kernel level.

Linux

Configuring auditd on Linux: Monitor Sensitive Files, Log User Commands, and Trace Intrusions

By IT From Zero October 21, 2026

A hands-on guide to configuring auditd on Linux: monitoring passwd/sudoers files, logging user commands by auid, tuning buffers to prevent disk overflow, and analyzing logs with ausearch.

Centos

Installing and Configuring Linux Auditd on CentOS Stream 9: Comprehensive Security Event Monitoring

By IT From Zero October 18, 2026

A hands-on guide to deploying Linux Auditd on CentOS Stream 9: configuring kernel rules, tracking original users with auid, and analyzing incident logs via ausearch and aureport.

Security

Ransomware Defense on Linux Servers: Proactive Protection, Early Detection, and Data Recovery

By IT From Zero June 17, 2026

A practical guide to Linux server ransomware defense using a defense-in-depth model: SSH hardening, abnormal encryption detection scripts, offline backups with BorgBackup, and an incident response plan for when things go wrong. Aimed at sysadmins and DevOps teams managing production servers.

Security

Auditd Configuration Guide: The “Black Box” for Tracking Every Change on Linux

By IT From Zero April 20, 2026

Hackers can wipe history but they can't hide from Auditd. A guide to configuring the Linux "black box" to trace file edits, command execution, and overall server security.