Ensure modification to TE system is audited

MittelStufe 1Automatisiertaix

Beschreibung

At Level 1, Trusted Execution (TE) should be actively monitoring for applications not yet allowlisted. The recommendation for this is in section two. Additionally, the AIX AUDIT system needs to be configured for modifications to the TE subsystem. Modification to security mechanisms need to be monitored to maintain system integrity. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

out=$(grep -E "^[[:blank:]]*default[[:blank:]]*=" /etc/security/audit/config 2>/dev/null) || exit 1; r=compliant; for p in '(=|,)[[:blank:]]*TE_Untrusted([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_FileWrite([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_Policies([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEAdd_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEDel_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TESwitch_algo([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEQuery_Stnz([[:blank:]]*,|[[:blank:]]*$)'; do printf '%s\n' "$out" | grep -Eq -- "$p" || r="missing: $p"; done; echo "$r"

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Ensure AUDIT Trusted Execution events are in the class default. 1. Edit the file /etc/security/audit/config 2. Find the stanza named classes: 3. If the class default does not exist add a line with: default = TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz 4. If the class default already exists ensure the following audit events are included in the class definition TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz

Eigenschaften

Betriebssysteme: Beliebig
Tags: aixaudit
Referenz: CIS IBM AIX 7 Benchmark v1.2.0 - 8.1.3 Ensure modification to TE system is audited

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target aix