Ensure session initiation information is collected

NiedrigStufe 2Automatisiertlinux

Beschreibung

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier "session." The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier "logins." Note: • The last command can be used to read /var/log/wtmp (last with no param

So wird geprüft

Prüfmethode: Shell-Befehl

shell

alt0() { o=$(bash -c 'grep -E '"'"'(session|logins)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/run/utmp -p wa -k session' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/run/utmp -p wa -k s'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/log/wtmp -p wa -k logins' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/log/wtmp -p wa -k l'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/log/btmp -p wa -k logins' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/log/btmp -p wa -k l'; return 1; }; o=$(bash -c 'auditctl -l | grep -E '"'"'(session|logins)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/run/utmp -p wa -k session' || { echo step2: missing '-w /var/run/utmp -p wa -k session'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/log/wtmp -p wa -k logins' || { echo step2: missing '-w /var/log/wtmp -p wa -k logins'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/log/btmp -p wa -k logins' || { echo step2: missing '-w /var/log/btmp -p wa -k logins'; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/session.rules and add the following lines: -w /var/run/utmp -p wa -k session -w /var/log/wtmp -p wa -k logins -w /var/log/btmp -p wa -k logins

Eigenschaften

Betriebssysteme: sles-12
Tags: cis-convertedlinux
Referenz: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.8

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target linux --level 2