Docker容器安全审计的常见漏洞，提供基于Linux auditd和Fluentd的完整日志方案

docker run -d --name=test-nginx nginx:alpine

# 查看默认审计日志（默认存储位置）
journalctl -u docker.service --since "5 minutes ago"

# 输出示例：
# Jun 15 10:00:01 node1 dockerd[1234]: time="2023-06-15T10:00:01Z" level=info msg="Container 123abc started"
# （缺少具体操作者、完整参数等关键信息）

# 安装审计工具
sudo apt install auditd -y

# 创建Docker审计规则文件
sudo tee /etc/audit/rules.d/docker.rules <<EOF
# 监控Docker守护进程
-w /usr/bin/dockerd -k docker
-w /var/lib/docker -k docker

# 监控容器生命周期事件
-a exit,always -F arch=b64 -S execve -F path=/usr/bin/docker -F key=docker_commands

# 监控容器文件修改
-w /var/lib/docker/containers/ -k docker_container
EOF

# 重新加载规则
sudo auditctl -R /etc/audit/rules.d/docker.rules

<source>
  @type tail
  path /var/log/audit/audit.log
  pos_file /var/log/audit/audit.log.pos
  tag audit.docker
  <parse>
    @type regexp
    expression /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(.*)/
    keys time, type, pid, uid, msg, extra
  </parse>
</source>

<filter audit.docker>
  @type grep
  <regexp>
    key msg
    pattern /docker/
  </regexp>
</filter>

<match audit.docker>
  @type elasticsearch
  host es01
  port 9200
  index_name docker-audit-%Y.%m.%d
  <buffer>
    @type file
    path /var/log/fluentd/buffer
  </buffer>
</match>

# 查询特定用户的容器操作
event.category:"docker" AND user.name:"admin"

# 追踪镜像删除事件
event.action:"image_delete" AND container.image.name:"nginx:*"

# 统计异常登录尝试
authentication.result:"failed" AND process.name:"dockerd"

# 调整auditd的速率限制（/etc/audit/auditd.conf）
rate_limit = 300
flush = INCREMENTAL_ASYNC

# 审计日志文件权限设置
chmod 0640 /var/log/audit/audit.log
setfacl -m u:fluentd:r /var/log/audit

PUT _ilm/policy/docker-audit
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50GB",
            "max_age": "30d"
          }
        }
      },
      "delete": {
        "min_age": "365d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

name: Docker特权操作告警
type: frequency
index: docker-audit-*
num_events: 1
timeframe:
  minutes: 1
filter:
- query:
    query_string:
      query: "event.action:privileged AND container.cap.add:*"
alert:
- "email"
email:
- "security-team@example.com"