githubmirror/audit-userspace

init.d/auditd.conf

51 строка1 KB

Sergio Correia

remove certificate-mode references from TLS configuration

15 июл 2026, 20:55

15 июл 2026, 20:557ee8c56

#
# This file controls the configuration of the audit daemon
#

local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
log_group = root
log_format = ENRICHED
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 8
num_logs = 5
priority_boost = 4
name_format = NONE
##name = mydomain
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
verify_email = yes
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
report_interval = 0
use_libwrap = yes
##tcp_listen_port = 60
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
transport = TCP
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key
## TLS transport options (requires transport = tls)
##tls_auth = psk
##tls_crypto_profile = compatible
##tls_psk_file = /etc/audit/tls/audit.psk
##tls_psk_identity = my-collector-01
##tls_allowed_clients = /etc/audit/tls/allowed_clients
## Advanced overrides (override profile defaults):
##tls_cipher_suites = TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
##tls_key_exchange = X25519MLKEM768:X25519
##tls_require_pqc = no
distribute_network = no
q_depth = 2000
overflow_action = SYSLOG
max_restarts = 10
plugin_dir = /etc/audit/plugins.d
end_of_event_timeout = 2