torjus/nixos-servers
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

testvm: add SSH session command auditing
Some checks failed
Run nix flake check / flake-check (push) Failing after 1s
Details

Browse Source 
Enable Linux audit to log execve syscalls from interactive SSH sessions.
Uses auid filter to exclude system services and nix builds.

Logs forwarded to journald for Loki ingestion. Query with:
{host="testvmXX"} |= "EXECVE"

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Torjus Håkestad
2026-02-08 03:07:10 +01:00
parent 70ec5f8109
commit 7fcc043a4d
4 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
common/ssh-audit.nix Normal file
View File

@@ -0,0 +1,21 @@
# SSH session command auditing
#
# Logs all commands executed by users who logged in interactively (SSH).
# System services and nix builds are excluded via auid filter.
#
# Logs are sent to journald and forwarded to Loki via promtail.
# Query with: {host="<hostname>"} |= "EXECVE"
{
# Enable Linux audit subsystem
security.audit.enable = true;
security.auditd.enable = true;
# Log execve syscalls only from interactive login sessions
# auid!=4294967295 means "audit login uid is set" (excludes system services, nix builds)
security.audit.rules = [
"-a exit,always -F arch=b64 -S execve -F auid!=4294967295"
];
# Forward audit logs to journald (so promtail ships them to Loki)
services.journald.audit = true;
}