SFTP 접근 기록 남기는 방법 (Auditd)

1. 현실적인 제한

1) 이미 레거시 코드와 라이브 패키지 서비스로 구현

2) 작업자의 교육 한계

3) 웹사이트 서비스에서의 형상관리라면

2. 보완 방법

3. auditd

3-1. 패키지 설치

sudo apt install auditd
Copy

dpkg -l | grep -E '^ii\s+auditd\b'
apt-cache policy auditdCopy

3-2. 룰 생성

sudo tee /etc/audit/rules.d/www_8100_source.rules >/dev/null <<'EOF'
-w /home/ubuntu/www/8100/app -p wa -k src_8100
-w /home/ubuntu/www/8100/config -p wa -k src_8100
-w /home/ubuntu/www/8100/database -p wa -k src_8100
-w /home/ubuntu/www/8100/public -p wa -k src_8100
-w /home/ubuntu/www/8100/resources -p wa -k src_8100
-w /home/ubuntu/www/8100/routes -p wa -k src_8100
EOFCopy

3-3. 자동 룰 생성

sudo nano /usr/local/sbin/audit-refresh-www-rules.shCopy

#!/usr/bin/env bash
set -euo pipefail

BASE="/var/www"
OUT="/etc/audit/rules.d/www_sources.rules"
DIRS=(app config database public resources routes)

echo "# auto-generated $(date -Is)" > /tmp/www_sources.rules

for p in "$BASE"/*; do
  [ -d "$p" ] || continue
  name="$(basename "$p")"
  key="builder_${name}"
  for d in "${DIRS[@]}"; do
    if [ -d "$p/$d" ]; then
      echo "-w $p/$d -p wa -k $key" >> /tmp/www_sources.rules
    fi
  done
done

sudo mv /tmp/www_sources.rules "$OUT"
sudo augenrules --load
sudo systemctl restart auditd
echo "OK: refreshed audit rules in $OUT"Copy

/usr/local/sbin/audit-refresh-www-rules.shCopy

3-4. 로그레이트 설정

sudo nano /etc/audit/auditd.confCopy

local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
log_group = adm
log_format = RAW
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 8
num_logs = 5
priority_boost = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
verify_email = yes
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
##tcp_listen_port = 60
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key
distribute_network = noCopy

max_log_file = 50
num_logs = 20Copy

space_left = 8192
space_left_action = SYSLOG
admin_space_left = 4096
admin_space_left_action = SYSLOGCopy

3-5. 로그 기록 조회

sudo tail -f /var/log/audit/audit.logCopy

sudo ausearch -k builder_8100 --start todayCopy

----
type=PROCTITLE msg=audit(02/24/26 15:02:01.269:5644) : proctitle=/usr/lib/openssh/sftp-server 
type=PATH msg=audit(02/24/26 15:02:01.269:5644) : item=1 name=/var/www/demo/app/Http/Controllers/Admin/FeeController.php inode=3197781 dev=103:01 mode=file,644 ouid=kiweb ogid=www-data rdev=00:00 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(02/24/26 15:02:01.269:5644) : item=0 name=/var/www/demo/app/Http/Controllers/Admin/ inode=3197775 dev=103:01 mode=dir,sgid,775 ouid=kiweb ogid=www-data rdev=00:00 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/24/26 15:02:01.269:5644) : cwd=/home/kiweb 
type=SYSCALL msg=audit(02/24/26 15:02:01.269:5644) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563f96ccd390 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=2 ppid=28422 pid=5340 auid=kiweb uid=kiweb gid=www-data euid=kiweb suid=kiweb fsuid=kiweb egid=www-data sgid=www-data fsgid=www-data tty=(none) ses=46453 comm=sftp-server exe=/usr/lib/openssh/sftp-server key=builder_demo 
----
type=PROCTITLE msg=audit(02/24/26 15:58:26.128:5892) : proctitle=/usr/lib/openssh/sftp-server 
type=PATH msg=audit(02/24/26 15:58:26.128:5892) : item=1 name=/var/www/demo/resources/views/app/home.blade.php inode=3197908 dev=103:01 mode=file,644 ouid=kiweb ogid=www-data rdev=00:00 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(02/24/26 15:58:26.128:5892) : item=0 name=/var/www/demo/resources/views/app/ inode=3197847 dev=103:01 mode=dir,sgid,775 ouid=kiweb ogid=www-data rdev=00:00 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/24/26 15:58:26.128:5892) : cwd=/home/kiweb 
type=SYSCALL msg=audit(02/24/26 15:58:26.128:5892) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x55f855949f40 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=2 ppid=19146 pid=19147 auid=kiweb uid=kiweb gid=www-data euid=kiweb suid=kiweb fsuid=kiweb egid=www-data sgid=www-data fsgid=www-data tty=(none) ses=46429 comm=sftp-server exe=/usr/lib/openssh/sftp-server key=builder_demo Copy

4. 마무리