Ensure events that modify the sudo log file are collected

HochStufe 2Automatisiertfreebsd

Beschreibung

Monitor the sudo log file. If the system has been properly configured to disable the use of the su command and force all administrators to have to log in first and then use sudo to execute privileged commands, then all administrator commands will be logged to /var/log/sudo.log. Changes in /var/log/sudo.log indicate that an administrator has executed a command or the log file itself has been tampered with. Audit: the global flags: line in /etc/security/audit_control must include fa,fc,fd,fm,fr,fw.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

l=$(grep "^flags:" /etc/security/audit_control 2>/dev/null) || exit 1; f=",${l#flags:},"; r=compliant; for c in fa fc fd fm fr fw; do case "$f" in *,$c,*|*,+$c,*) ;; *) r="flags missing $c";; esac; done; echo "$r"

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Add the classes fa,fc,fd,fm,fr,fw to the flags: line in /etc/security/audit_control, then run audit -s.

Eigenschaften

Betriebssysteme: Beliebig
Tags: freebsdaudit
Referenz: CIS FreeBSD 14 Benchmark v1.0.1 - 5.2.3.2 Ensure events that modify the sudo log file are collected

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target freebsd --level 2