AUDISPD-ZOS-REMOTE(8)

💖 AUDISPD-ZOS-REMOTE 💖 (section 8, bestie — the z/OS Remote-services Audit dispatcher plugin)

okay so picture this: it's audispd-zos-remote, and it's literally the plugin that carries your Linux audit tea all the way over to a mainframe. no cap. let's get into it 🫶

---

✨ NAME ✨

audispd-zos-remote — the z/OS Remote-services Audit dispatcher plugin 🌸

---

🎀 SYNOPSIS 🎀

audispd-zos-remote [ config-file ]

---

🦋 DESCRIPTION 🦋

So audispd-zos-remote is a remote-auditing plugin for the Audit subsystem, and the way it works is chef's kiss. It should be started by the auditd(8) daemon, and then it forwards all incoming audit events — like, as they happen, no buffering drama — to a configured z/OS SMF (Service Management Facility) database. How does it get there? Through an IBM Tivoli Directory Server (ITDS) that's been set up for Remote Audit service. 💅 If you wanna know what the resulting SMF record actually looks like, scroll down to the SMF MAPPING section, bestie.

Now, auditd(8) has to be configured to start the plugin. That's done with a configuration file that usually lives at /etc/audit/plugins.d/audispd-zos-remote.conf — but here's the slay part: you can spawn multiple instances of it by having multiple configuration files in /etc/audit/plugins.d for the same plugin executable (again, see auditd(8) for the deets). 👑

Every single instance needs its own configuration file, and by default that's at /etc/audit/zos-remote.conf. Go check zos-remote.conf(5) for all the details about the plugin configuration. 🌈

---

⭐ OPTIONS ⭐

• config-file — use an alternate configuration file instead of /etc/audit/zos-remote.conf. that's it, that's the option 🎀

---

💀 SIGNALS 💀

audispd-zos-remote reacts to SIGTERM and SIGHUP signals — and yes, this is per the auditd(8) specification, it's not just vibing on its own:

• SIGHUP — tells the audispd-zos-remote plugin to re-read its configuration and flush existing network connections. glow-up time ✨
• SIGTERM — performs a clean exit. audispd-zos-remote will wait up to 10 seconds if there are queued events to be delivered, and then drops any remaining queued events after that time. 😭 so if it's slow, those events are gone-gone.

---

👑 IBM z/OS ITDS Server and RACF configuration 👑

To even use this plugin you need an IBM z/OS v1R8 (or higher) server with IBM Tivoli Directory Server (ITDS) configured for Remote Audit service. Periodt.

For the detailed scoop on how to configure the z/OS server for Remote Auditing, go read the z/OS V1R8.0-9.0 Integrated Security Services Enterprise Identity Mapping (EIM) Guide and Reference — here's the link they gave us:

http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/FRAMESET/EIMA1140/CCONTENTS?DT=20070827115119

and specifically chapter "2.0 - Working with remote services". 📚

🧚 Enable ITDS to process Remote Audit requests

For ITSD to process Remote Audit requests, the user ID associated with ITDS has to be granted READ access to the IRR.AUDITX FACILITY Class profile (that's the profile used to protect the R_Auditx service). You can usually find this user ID in the STARTED Class profile for the ITDS started procedure. If the identity associated with ITDS is ITDSUSER, the administrator can configure RACF to grant Remote Auditing processing to ITDS with these TSO commands:

TSO Commands: Grant ITDSUSER READ access to IRR.AUDITX FACILITY Class profile

rdefine FACILITY IRR.RAUDITX uacc(none)
permit IRR.RAUDITX class(FACILITY) id(ITDSUSER) access(READ)

🍓 Create/enable RACF user ID to perform Remote Audit requests

A z/OS RACF user ID is needed by the plugin — every Audit request the plugin performs will use a RACF user ID, as configured in the plugin configuration zos-remote.conf(5). That user ID needs READ access to FACILITY Class resource IRR.LDAP.REMOTE.AUDIT. If the user ID is BINDUSER, the administrator can configure RACF to enable this user to perform Remote Auditing requests with these TSO commands:

TSO Commands: Enable BINDUSER to perform Remote Audit requests

rdefine FACILITY IRR.LDAP.REMOTE.AUDIT uacc(none)
permit IRR.LDAP.REMOTE.AUDIT class(FACILITY) id(BINDUSER) access(READ)

🌸 Add @LINUX Class to RACF

When performing remote auditing requests, the audispd-zos-remote plugin will use the special @LINUX CDT Class and the audit record type (eg.: SYSCALL, AVC, PATH...) as the CDT Resource Class for all events processed. So to make sure events are actually logged, the RACF server must be configured with a Dynamic CDT Class named @LINUX with correct sizes and attributes. These TSO commands add that class:

TSO Commands: Add @LINUX CDT Class

rdefine cdt @LINUX cdtinfo(posit(493) FIRST(alpha,national,numeric,special) OTHER(alpha,national,numeric,special) RACLIST(REQUIRED) case(asis) generic(allowed) defaultuacc(none) maxlength(246))
setr classact(cdt)
setr raclist(cdt)
setr raclist(cdt) refresh
setr classact(@LINUX)
setr raclist(@LINUX)
setr generic(@LINUX)

💜 Add profiles to the @LINUX Class

Once that CDT Class is defined, you can add profiles to it, specifying resources (wildcards allowed) to log or ignore. Here are some examples:

TSO Commands: Log only AVC records (One generic and one discrete profile):

rdefine @LINUX * uacc(none) audit(none(read))
rdefine @LINUX AVC uacc(none) audit(all(read))
setr raclist(@LINUX) refresh

TSO Commands: Log everything (One generic profile):

rdefine @LINUX * uacc(none) audit(all(read))
setr raclist(@LINUX) refresh

Resources always match the single profile with the best match. 🎯

There are many other ways to define logging in RACF — please refer to the server documentation for more details, because we are not about to guess. 🙈

---

🌈 SMF Mapping 🌈

The ITDS Remote Audit service will cut SMF records of type 83 subtype 4 every time it processes a request. This plugin will issue a remote audit request for every incoming Linux Audit record — meaning one Linux record will map to one SMF record — and fill this type's records with the following:

Link Value

The Linux event serial number, encoded in network-byte order hexadecimal representation. Records within the same Event share the same Link Value. 🔗

Violation

Always zero (0) - False.

Event Code

Always two (2) - Authorization event.

Event Qualifier

• Zero (0) - Success, if the event reported success=yes or res=success
• Three (3) - Fail, if the event reported success=no or res=failed
• or One (1) - Info otherwise.

Class

Always @LINUX.

Resource

The Linux record type for the processed record. e.g.: SYSCALL,AVC,PATH,CWD etc.

Log String

Textual message bringing the RACF user ID used to perform the request, plus the Linux hostname and the record type for the first record in the processed event. e.g.: Remote audit request from RACFUSER. Linux (hostname.localdomain):USER_AUTH

Data Field List

Also known as relocates, this list will bring all the field names and values in a fieldname=value format, as a type 114 (Application specific Data) relocate. The plug-in will try to interpret those fields (i.e.: use human-readable username root instead of numeric userid 0) whenever possible. Currently, this plugin will also add a relocate type 113 (Date And Time Security Event Occurred) with the Event Timestamp in the format as returned by ctime(3). 🕐

---

😭 ERRORS 😭

Errors and warnings are reported to syslog (under DAEMON facility). In situations where the event was submitted but the z/OS server returned an error condition, the logged message brings a name followed by a human-readable description. Below are some common error conditions — memorize these, iykyk:

• NOTREQ - No logging required — Resource (audit record type) is not set to be logged in the RACF server. The @LINUX Class profile governing this audit record type is set to ignore. See IBM z/OS RACF Server configuration.
• UNDETERMINED - Undetermined result — No profile found for specified resource. There is no @LINUX Class configured or no @LINUX Class profile associated with this audit record type. See IBM z/OS RACF Server configuration.
• UNAUTHORIZED - The user does not have authority the R_auditx service — The user ID associated with the ITDS doesn't have READ access to the IRR.AUDITX FACILITY Class profile. See IBM z/OS RACF Server configuration.
• UNSUF_AUTH - The user has insufficient authority for the requested function — The RACF user ID used to perform Remote Audit requests (as configured in zos-remote.conf(5)) don't have access to the IRR.LDAP.REMOTE.AUDIT FACILITY Class profile. See IBM z/OS RACF Server configuration.

---

🙈 BUGS 🙈

The plugin currently does remote auditing in a best-effort basis, and will discard events in case the z/OS server cannot be contacted (network failures) or in any other case that event submission fails. so yeah, if the network ghosts you, those events are just… gone. 💀

---

🧚 FILES 🧚

• /etc/audit/plugins.d/audispd-zos-remote.conf
• /etc/audit/zos-remote.conf

---

🔥 SEE ALSO 🔥

auditd(8), zos-remote.conf(5).

---

🫶 AUTHOR 🫶

Klaus Heinrich Kiwi <klausk@br.ibm.com> — thank you for your service king 👑

---

and that's the whole page bestie!! this one came from IBM, dated Oct 2007, and it's AUDISPD-ZOS-REMOTE(8) forever and always 💖 stay audited, stay iconic ✨🎀