How Can I Improve My Security?

26 March 2025, 14:55:10

Not to get too complicated, just a couple of basics this post.

User Groups:
It is mentioned in the Configurations PDF but doesn't offer solutions.
How do I determine what I'm using and which ones I can limit?
Which application will I be using to set root:root 0700 or 0400?

Logs:
Auditd: Instead of ausearch, what visualization solutions are available?
I'm looking into Grafana, Loki, and Alloy as a solution. They are not as heavy as other packages relying on Elasticsearch, like Wazuh or Graylog.
The problem with ausearch, I need to know all of the key= in order to do a good parsing and I still don't know on which key= I should start my search with, just clunky. A graphic visualization tool will help narrow down the trouble spots to search around.