Skip to main content ↑ ↓
Recent Posts
11
System / Re: Auditd: How do I set it up and use it?
Last post by tsedek1 -
How I managed with other Arch Distro's is changing. Artix is straightening me out.
2 minutes to install
Auditd is working....

Code: [Select]
type=PROCTITLE msg=audit(01/04/25 13:35:30.507:1275) : proctitle=/usr/bin/pulseaudio --start --log-target=syslog 
type=SYSCALL msg=audit(01/04/25 13:35:30.507:1275) : arch=x86_64 syscall=memfd_create success=yes exit=41 a0=0x799a836d054a a1=0xb a2=0x0 a3=0x0 items=0 ppid=1 pid=2458 auid=WhatsMyName uid=WhatsMyName gid=WhatsMyName euid=WhatsMyName suid=WhatsMyName fsuid=WhatsMyName egid=WhatsMyName sgid=WhatsMyName fsgid=WhatsMyName tty=(none) ses=1 comm=pulseaudio exe=/usr/bin/pulseaudio key=anon_file_create

Like a glove. :nods head:
Now, getting rid of LightDM, the next 'ToDo'. tsedek1 hollers, "Slim...Where you at?"
12
System / Re: Artix-xfce-openrc: How to use OpenRc?
Last post by lotuskip -
I haven't used the live ISOs in years, but I do agree that they should have relevant init scripts for included packages. If it is the case that audit-openrc isn't there, it should be added. (Note that the package is audit-openrc without the 'd'.)

Not very familiar with nftables, but just the fact that it is in the [world] repo instead of [system] suggests that it is not considered a core component yet. Artix, while very stable (thanks, devs!), is a fairly bleeding-edge distro.

I'm also pretty sure iptables still covers "basic security"...
13
System / Re: Auditd: How do I set it up and use it?
Last post by tsedek1 -
Quote from: lotuskip – on
I don't personally use auditd, but
Quote from: man auditd
DESCRIPTION
 auditd  is  the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities. Configuring the audit system or loading rules is done with the auditctl  utility.  During  startup,  the  rules  in /etc/audit/audit.rules  are  read  by auditctl and loaded into the kernel. Alternately, there is also an augenrules program that reads rules located in /etc/audit/rules.d/ and compiles them into an audit.rules file. The audit daemon itself has some configuration options that the admin may wish to  customize. They are found in the auditd.conf file.

I have moved the 'audit.rules' to /etc/audit/. I'll reboot and see what the effect will be.
14
System / Re: Auditd: How do I set it up and use it?
Last post by lotuskip -
I don't personally use auditd, but
Quote from: man auditd
DESCRIPTION
 auditd  is  the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities. Configuring the audit system or loading rules is done with the auditctl  utility.  During  startup,  the  rules  in /etc/audit/audit.rules  are  read  by auditctl and loaded into the kernel. Alternately, there is also an augenrules program that reads rules located in /etc/audit/rules.d/ and compiles them into an audit.rules file. The audit daemon itself has some configuration options that the admin may wish to  customize. They are found in the auditd.conf file.
15
System / Re: Artix-xfce-openrc: How to use OpenRc?
Last post by tsedek1 -
Quote from: Ambie – on
Quote from: tsedek1 – on
When I 'sudo pacman -Sy nftables' are you saying nftables-openrc doesn't get downloaded with it?
There are different init systems in Artix. Selecting and installing corresponding init services mostly is a user's job.
When I download the Artix-XFCE-OpenRC.iso it should be understood that auditd-openrc will be included because it is an OpenRC platform. It isn't a genral iso, it is a specific iso.
nftables is the new standard for Linux firewalls, so including it is sensible.
The ability to have basic security enabled before connecting to the internet is important to me.
16
System / Re: Auditd: How do I set it up and use it?
Last post by tsedek1 -
Here is a sample of what is in the audit.log:

Code: [Select]
type=USER_LOGOUT msg=audit(1743492422.998:15): pid=2267 uid=0 auid=1000 ses=1 msg='op=logout id=1000 exe="/usr/bin/lightdm" hostname=talmudeem_sell_their_children_to_be_whores addr=? terminal=/dev/tty7 res=success'UID="root" AUID="WhatsMyName" ID="WhatsMyName"

Looks like it isn't reading the audit.rules file. There are no 'key=' entries.
I put the 'audit.rules' file in '/etc/audit/rules.d/audit.rules'
17
System / Auditd: How do I set it up and use it?
Last post by tsedek1 -
Maybe I'm misunderstanding how Audit should be setup and configured in Artix.

Code: [Select]
rc-service auditd start
rc-update add auditd
reboot
Code: [Select]
ausearch -i -k recon
<no matches>
ausearch -i -k shell
<no matches>
ausearch -i -k anon_file_creation
<no matches>
I'll cat the log file and see what's in it.

I've gone to the mirror site, in 'system' downloaded the 'audit-openrc' file. Now I'll have it for later.
In 'World', and downloaded the 'nftables' and 'nftables-openrc' files.
Do I need to save the .sig file also?

::I have taken this from a Feature Request Topic in Software Development. I think Auditd deserves it's own thread.::
18
Software development / Re: Feature Request:
Last post by tsedek1 -
Code: [Select]
type=USER_LOGOUT msg=audit(1743492422.998:15): pid=2267 uid=0 auid=1000 ses=1 msg='op=logout id=1000 exe="/usr/bin/lightdm" hostname=talmudeem_sell_their_children_to_be_whores addr=? terminal=/dev/tty7 res=success'UID="root" AUID="WhatsMyName" ID="WhatsMyName"

Looks like it isn't reading the audit.rules file. There are no 'key=' entries.
I put the 'audit.rules' file in '/etc/audit/rules.d/audit.rules'
19
Software development / Re: Feature Request:
Last post by tsedek1 -
Quote from: lotuskip – on
As for number 3, how would it not be already installed?
audit (the package for auditd) is required by shadow is required by base.
You need to download 'audit-openrc' for it to work. I'm testing it out right now.

Maybe I'm misunderstanding how Audit should be setup and configured in Artix.
Code: [Select]
rc-service auditd start
rc-update add auditd
reboot
Code: [Select]
ausearch -i -k recon
<no matches>
ausearch -i -k shell
<no matches>
ausearch -i -k anon_file_creation
<no matches>
I'll cat the log file and see what's in it.

I've gone to the mirror site, in 'system' downloaded the 'audit-openrc' file. Now I'll have it for later.
In 'World', and downloaded the 'nftables' and 'nftables-openrc' files.
Do I need to save the .sig file also?

20
Package management / Re: omniverse is up to date/or/failed retrieving file 'omniverse.db' url:404
Last post by tsedek1 -
Quote from: Shoun2137 – on

Spoiler (click to show/hide)
If I click it, will it spawn an XSS exploit that lets them pivot to the router and cameras?
There was a parody of a Rick Ross song called 'I Eat Snacks.'
I could parody that with 'I Click Links'.

It is working. Updates like it should. "In the Omniverse, you keep what you download. It is the Pacman-monger way."
Do you think AI can generate an image combining Pacman and a Necromonger?
edit:
Installed pacman-contrib and ran rankmirrors, then put it at the top of the list.
Success.
That should clear up some of the speed management issues.
SOLVED
MethCafe - Coffee is the original energy drink...
Artix forum uses a single cookie to remember youOK