Repository navigation
Add Linux support: auditd, journald, shell logging, offline prep - #2
Merged
Merged
Conversation
linux/install.sh: - installs auditd and the Neo23x0 ruleset (Apache-2.0, bundled with its license), adjusting UID_MIN from /etc/login.defs - keeps more audit history (200 MB x 10 logs) and writes events to disk synchronously - makes journald persistent with rate limiting off - logs interactive bash commands to syslog (local6) - --with-sysmon installs Sysmon for Linux from Microsoft's repo (experimental, opt-in, not bundled) - --dry-run, --revert (tracks created files and backs up edited ones), and a lab-only confirmation, mirroring the Windows script - re-enables kernel auditing as the last step (restarting journald on Ubuntu 22.04 switches it off) linux/prepare-offline.sh downloads the packages (apt, dnf/dnf5, yum, zypper, pacman) with a SHA256SUMS file for air-gapped labs. tests/test-linux.sh and CI jobs run the flow on Ubuntu 22.04 and 24.04, and the dnf paths in a Fedora container (no systemd there, so the live kernel checks are skipped). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ClaySecAI
added a commit
that referenced
this pull request
Oct 17, 2026
Add Linux support: auditd, journald, shell logging, offline prep
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Linux support alongside the Windows scripts.
linux/install.shinstalls auditd with the Neo23x0 ruleset (Apache-2.0, bundled with its license) and adjustsUID_MINfrom/etc/login.defs.local6);--no-shell-loggingskips it.--with-sysmoninstalls Sysmon for Linux from Microsoft's package repo. Experimental, opt-in, and not bundled.--dry-run,--revert(tracks files it created and backs up files it edits) and a lab-only confirmation, mirroring the Windows script.linux/prepare-offline.shdownloads the packages (apt, dnf/dnf5, yum, zypper, pacman) with aSHA256SUMSfile for air-gapped labs;install.sh --offline-dirverifies it before installing.Testing
tests/test-linux.shruns dry-run, offline prep, offline install, a real exec event check (ausearch), a re-run and--revert. CI runs it on Ubuntu 22.04 and 24.04, and all jobs pass, including the existing Windows Server 2022/2025 jobs.Fedora runs in a container, so it validates package install (dnf5), config edits and revert only. There is no systemd or kernel audit there, so the live checks are skipped and reported as skipped.
Not yet tested: RHEL-family (Rocky/Alma, dnf4 and the
service auditd restartpath), Debian, Kali, openSUSE (zypper), Arch (pacman), and--with-sysmon.Not included
macOS, and Windows audit coverage changes (separate work).