How to control POSIX Identity Lookup done by Linux Auditd app?

[att35]

Hi,

We use Linux Auditd app in our environment in conjunction with Splunk Enterprise Security (ES). Is there a way to control the POSIX Identity lookup which is done automatically in the background. /opt/splunk/etc/apps/TA_linux-auditd/lookups/posix_identities.csv


The identities for LDAP users logging on the Linux machines are mapped correctly, but we are running into two specific issues where the mapping is causing wrong user to populate in the searches:

1. Some servers still support local login, in which case POSIX lookup csv starts adding entries for local UID's for the users, but that will change from one server to another. e.g. UID 500 mapped to local user "abc" might not be the same on another server.

2. It keeps mapping uid 4294967295 with a specific user. If I delete that entry it will repopulate the csv for this uid for another random user. I think this ID is meant only for internal system processing and should not be mapped to any specific user.

How can we get some control over this csv file? If we simply delete this csv file, what possible issues might arise?

Thanks,

~ Abhi

[doksu]

Regarding the issues raised:

1. Having consistent uids across your infrastructure is essential to the centralised interpretation of audit events because auditd logs with uids. There are ways to work around this, but they involve things that are essentially hacks and would also necessitate significant changes to the fundamentals of how the app is designed to work.
2. The 4294967295 uid issue has been fixed in the latest release. Please upgrade and let me know how it goes (remembering to also upgrade the TA).