Ensure actions as another user are always logged

NiedrigStufe 2Automatisiertlinux

Beschreibung

sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

alt0() { command -v auditctl >/dev/null 2>&1 || { echo "step1: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep execve' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S ex'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S ex'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep -Ps -- '"'"'execve'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F arch=b64 -S' || { echo step2: missing '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F arch=b32 -S' || { echo step2: missing '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation'; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

1. Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor elevated privileges. Example: # printf " -a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation -a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation " >> /etc/audit/rules.d/50-user_emulation.rules 2. Merge and load the rules into active configuration: # augenrules --load 3. Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Eigenschaften

Betriebssysteme: ubuntu-24.04
Tags: cis-convertedlinux
Referenz: CIS Ubuntu Linux 24.04 LTS Benchmark v2.0.0 - 6.2.3.2

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target linux --level 2