Is there a way to turn on login auditing?

[Cosmo_Kramer]

Hello,
I was wondering if there was a way to turn on user login auditing from the web UI?

Thanks for your help.

 

[DifferentStrokes]

Logon to what? WebGUI, SSH, CIFS shares?

 

[joeschmuck]

Sure but from what I can figure out, it's not straight forward like windoze is. As far as I can tell, this does not record logging into the GUI.

Assuming you are using FreeNAS 9.3.x and you have a clue about using the tunables, CRON, and SSH (or shell), do the following...

1) Read chapter 16 here for an idea of how auditing works before you proceed. There is a lot of boring reading and some good stuff but it will help you in the long run.
2) In the GUI add a tunable to automatically start the audit daemon:
Variable = auditd_enable
Value = YES
Type = rc.conf
Comment = Enable Audit Logging
Enabled = checked
3)Now reboot your NAS or you could open a shell and enter "service auditd start".

So, the above steps get the auditing process started. Now you need to be able to read the results.

4) In a SSH (shell) enter the following command we may need to edit the audit_control file at /conf/base/security/audit_control and edit the file to record what you are looking to trap. Unfortunately the aa and lo values do not appear to trap any GUI login action which are the default values, however any SSH attempt is logged. Also, do not select "all" because it will fill up the logs very fast and this does not appear very useful. This will be pushed to the /etc/security/audit_control file once the system reboots.
5) To view the log you will need to manually go through the SSH (shell) and use the line "praudit /var/audit/2015xxxxxx.2015xxxxxxx" (where the x's are the filename) and this will dump to the screen the readable audit log.

So I'm not sure this will do what you desire but it will lead you down some path to help. If there is a way to log GUI login/logout, I'd like to hear it.

 

[Cosmo_Kramer]

Sure but from what I can figure out, it's not straight forward like windoze is. As far as I can tell, this does not record logging into the GUI.

Assuming you are using FreeNAS 9.3.x and you have a clue about using the tunables, CRON, and SSH (or shell), do the following...

1) Read chapter 16 here for an idea of how auditing works before you proceed. There is a lot of boring reading and some good stuff but it will help you in the long run.
2) In the GUI add a tunable to automatically start the audit daemon:
Variable = auditd_enable
Value = YES
Type = rc.conf
Comment = Enable Audit Logging
Enabled = checked
3)Now reboot your NAS or you could open a shell and enter "service auditd start".

So, the above steps get the auditing process started. Now you need to be able to read the results.

4) In a SSH (shell) enter the following command we may need to edit the audit_control file at /conf/base/security/audit_control and edit the file to record what you are looking to trap. Unfortunately the aa and lo values do not appear to trap any GUI login action which are the default values, however any SSH attempt is logged. Also, do not select "all" because it will fill up the logs very fast and this does not appear very useful. This will be pushed to the /etc/security/audit_control file once the system reboots.
5) To view the log you will need to manually go through the SSH (shell) and use the line "praudit /var/audit/2015xxxxxx.2015xxxxxxx" (where the x's are the filename) and this will dump to the screen the readable audit log.

So I'm not sure this will do what you desire but it will lead you down some path to help. If there is a way to log GUI login/logout, I'd like to hear it.

Thank you I appreciate your help. I was mostly looking for a way to audit Web GUI logins as I have auditing enabled for SSH already.

Does your method audit other types of logins such as SMB logins?

 

[joeschmuck]

I have no idea but you could give it a try to see what happens. And to be honest, even though I tested this briefly using my real NAS, I should have used my VM Test NAS. So I'd recommend you create a VM of FreeNAS and test it that way if you screw something up, it's no big deal.