Enable Auditing of Incoming Network Connections

So wird geprüft

Prüfmethode: Shell-Befehl

[ -r /etc/security/audit_event ] || exit 1; r=compliant; for e in AUE_ACCEPT AUE_CONNECT AUE_SOCKACCEPT AUE_SOCKCONNECT AUE_inetd_connect; do awk -F: -v e="$e" '$2==e && $4 ~ /(^|,)cis(,|$)/ {f=1} END {exit !f}' /etc/security/audit_event || r="$e not assigned to the cis class"; done; echo "$r"

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

To enforce this setting, run the following commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # cp /etc/security/audit_event /etc/security/audit_event.orig # awk 'BEGIN{FS=":"; OFS=":"} {if ($2 ~ /AUE_ACCEPT|AUE_CONNECT|AUE_SOCKACCEPT|AUE_SOCKCONNECT|AUE_inetd_connect/) $4=$4",cis";} {print} ' /etc/security/audit_event > /etc/security/audit_event.out # cp /etc/security/audit_event.out /etc/security/audit_event

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target solaris