Splunk Enterprise Security

How to control POSIX Identity Lookup done by Linux Auditd app?

att35
Builder

Hi,

We use Linux Auditd app in our environment in conjunction with Splunk Enterprise Security (ES). Is there a way to control the POSIX Identity lookup which is done automatically in the background. /opt/splunk/etc/apps/TA_linux-auditd/lookups/posix_identities.csv

The identities for LDAP users logging on the Linux machines are mapped correctly, but we are running into two specific issues where the mapping is causing wrong user to populate in the searches:

  1. Some servers still support local login, in which case POSIX lookup csv starts adding entries for local UID's for the users, but that will change from one server to another. e.g. UID 500 mapped to local user "abc" might not be the same on another server.

  2. It keeps mapping uid 4294967295 with a specific user. If I delete that entry it will repopulate the csv for this uid for another random user. I think this ID is meant only for internal system processing and should not be mapped to any specific user.

How can we get some control over this csv file? If we simply delete this csv file, what possible issues might arise?

Thanks,

~ Abhi

doksu
SplunkTrust
SplunkTrust

Regarding the issues raised:

  1. Having consistent uids across your infrastructure is essential to the centralised interpretation of audit events because auditd logs with uids. There are ways to work around this, but they involve things that are essentially hacks and would also necessitate significant changes to the fundamentals of how the app is designed to work.
  2. The 4294967295 uid issue has been fixed in the latest release. Please upgrade and let me know how it goes (remembering to also upgrade the TA).
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...