Ensure events that modify user/group information are collected

NiedrigStufe 2Automatisiertlinux

Beschreibung

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier "identity" in the audit log file. Note: Reloading the auditd config to set active settings may require a system reboot.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep identity /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/identity.rules:-w /etc/group -p wa -k identity' || { echo step1: missing '/etc/audit/rules.d/identity.rules:-w /etc/group -p wa -k ide'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/identity.rules:-w /etc/passwd -p wa -k identity' || { echo step1: missing '/etc/audit/rules.d/identity.rules:-w /etc/passwd -p wa -k id'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/identity.rules:-w /etc/shadow -p wa -k identity' || { echo step1: missing '/etc/audit/rules.d/identity.rules:-w /etc/shadow -p wa -k id'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/identity.rules:-w /etc/security/opasswd -p wa -k identity' || { echo step1: missing '/etc/audit/rules.d/identity.rules:-w /etc/security/opasswd -'; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step2: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep identity' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/group -p wa -k identity' || { echo step2: missing '-w /etc/group -p wa -k identity'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/passwd -p wa -k identity' || { echo step2: missing '-w /etc/passwd -p wa -k identity'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/shadow -p wa -k identity' || { echo step2: missing '-w /etc/shadow -p wa -k identity'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/security/opasswd -p wa -k identity' || { echo step2: missing '-w /etc/security/opasswd -p wa -k identity'; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/identity.rules and add the following lines: -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identity

Eigenschaften

Betriebssysteme: sles-12
Tags: cis-convertedlinux
Referenz: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.4

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target linux --level 2