Ensure auditing for processes that start prior to auditd is enabled

So wird geprüft

Prüfmethode: Shell-Befehl

alt0() { command -v find >/dev/null 2>&1 || { echo "step1: find not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'find /boot -type f -name '"'"'grub.cfg'"'"' -exec grep -Ph -- '"'"'^\h*linux'"'"' {} + | grep -v '"'"'audit=1'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Edit /etc/default/grub or a file in /etc/default/grub.d/ ending in .cfg and append audit=1 to the existing GRUB_CMDLINE_LINUX value. Note: Files in /etc/default/grub.d/ are sourced sequentially by /etc/default/grub. A bare assignment like GRUB_CMDLINE_LINUX="audit=1" will replace any existing value (silently dropping parameters such as quiet splash). Always expand the existing variable when appending. Example: # printf '\nGRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} audit=1"\n' >> /etc/default/grub.d/40-custom.cfg Run the following command to update the grub2 configuration: # update-grub A reboot is required for the kernel command-line parameter to take effect.

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target linux --level 2