https://github.com/osquery/osquery logo
#linux
Title
m

Mystery Incorporated

12/05/2020, 11:52 AM
Yo, is it possible to detect addition/removal of UFW rules on Linux?
c

CptOfEvilMinions

12/05/2020, 6:30 PM
UFW is a fancy wrapper around iptables for Linux. You could use the Osquery
iptables
, however you will need to instruct Osquery to generate logs for addition/removal of IPtables. osquery config:
Copy code
{
  "schedule": {
    "iptables_monitor": {
      "query": "SELECT * FROM iptables",
      "interval": 60,
      "removed": true
    }
  }
}
m

Mystery Incorporated

12/06/2020, 10:05 AM
Oh yep, i think any modification to the iptables rules will triger a remove and add into the table yea? So I can just look for added/removed events on that table in the logs and I can know that iptables has been modified in theory right?
c

CptOfEvilMinions

12/06/2020, 4:16 PM
Yup but I would test it first
👍 1
m

Mystery Incorporated

12/15/2020, 1:52 AM
OFC, thanks
2 Views