Linux

Overview

Linux is an open-source operating system kernel that forms the foundation of many server and desktop distributions. The Linux app handles core Linux system services including SSH authentication, privilege escalation (sudo/su/dzdo), scheduled tasks (cron), and service management (systemd).

App Function

• Parse sshd, sudo, su, dzdo (Centrify), cron, and systemd log messages
• Extract user, source IP, command, and service metadata
• Categorize events by Event Class (auth, system)
• Map security events to MITRE ATT&CK techniques
• Provide dashboards for authentication and system monitoring
• Alert on authentication failures and privilege escalation

Vendor Documentation

• OpenSSH sshd Manual - SSH daemon configuration
• OpenSSH Logging - SSH log levels
• sudo Manual - Privilege escalation
• Delinea dzdo - Centrify/Delinea privilege escalation
• systemd Logging - Service and journal logging
• cron Manual - Scheduled tasks

Device Configuration

Configure Linux to forward syslog messages to LogZilla. Replace LOGZILLA_IP with the LogZilla server IP address or DNS name.

syslog-ng

Add the following to /etc/syslog-ng/syslog-ng.conf:

text
Wrap: OnCopyFullscreen
destination d_logzilla { udp("LOGZILLA_IP" port(514)); };
log { source(s_src); destination(d_logzilla); };

Restart syslog-ng: systemctl restart syslog-ng

rsyslog

Create a configuration file to forward all logs:

bash
Wrap: OnCopyFullscreen
cat > /etc/rsyslog.d/50-logzilla.conf << 'EOF'
# Forward all logs to LogZilla
*.* @LOGZILLA_IP:514
EOF
systemctl restart rsyslog

For TCP transport, use @@ instead of @:

text
Wrap: OnCopyFullscreen
*.* @@LOGZILLA_IP:514

Verification

Generate a test event and verify it appears in LogZilla:

bash
Wrap: OnCopyFullscreen
logger -t sshd "Test message from Linux"

Incoming Log Format

Linux syslog messages follow the standard RFC 3164/5424 format:

text
Wrap: OnCopyFullscreen
<priority>timestamp hostname program[pid]: message

• priority - Facility and severity combined
• timestamp - Event timestamp
• hostname - Source host
• program - Process name (sshd, sudo, su, CRON, systemd)
• pid - Process ID
• message - Event-specific content

Parsed Metadata Fields

Log Examples

SSH Failed Password

text
Wrap: OnCopyFullscreen
sshd[12345]: Failed password for invalid user admin from 192.168.1.100 port 54321

SSH Successful Login

text
Wrap: OnCopyFullscreen
sshd[12345]: Accepted publickey for jdoe from 192.168.1.100 port 54321 ssh2

Sudo Command

text
Wrap: OnCopyFullscreen
sudo: jdoe : TTY=pts/0 ; PWD=/home/jdoe ; USER=root ; COMMAND=/bin/bash

Su User Switch

text
Wrap: OnCopyFullscreen
su: Successful su for root by jdoe

Cron Job

text
Wrap: OnCopyFullscreen
CRON[67890]: (root) CMD (/usr/local/bin/backup.sh)

Systemd Service Started

text
Wrap: OnCopyFullscreen
systemd: Started nginx.service.

Systemd Service Failed

text
Wrap: OnCopyFullscreen
systemd: Failed to start mysql.service.

Systemd User Session

text
Wrap: OnCopyFullscreen
systemd: Started Session 4821 of User root.

Tagged as Service: User Session and User: root; the session id is dropped because it never repeats.

dzdo (Centrify) Privilege Escalation

text
Wrap: OnCopyFullscreen
adclient[2191]: INFO AUDIT_TRAIL|Centrify Suite|dzdo|1.0|0|dzdo granted|5|user=jdoe(type:ad,[email protected]) pid=32224 status=GRANTED service=dzdo command=/bin/bash runas=root role=ROLE_ADMIN

Dashboards

Triggers