Ensure cryptographic mechanisms are used to protect the integrity of audit tools

NiedrigStufe 2Automatisiertlinux

Beschreibung

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. aide.conf is case-sensitive. Leading and trailing white spaces are ignored. Each config lines must end with new line. AIDE uses the backslash character \ as escape character for ' ' (space), '@' and '' (backslash) (e.g. '\ ' or '@'). To literally match a '' in a file path with a regular expression you have to escape the backslash twice (i.e. '\\'). There are th

So wird geprüft

Prüfmethode: Shell-Befehl

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_output=() a_output2=() l_tool_dir="$(readlink -f /sbin)"
   a_items=("p" "i" "n" "u" "g" "s" "b" "acl" "xattrs" "sha512")
   l_aide_cmd="$(whereis aide | awk '"'"'{print $2}'"'"')"
   a_audit_files=("auditctl" "auditd" "ausearch" "aureport" "augenrules")
   if [ -f "$l_aide_cmd" ] && command -v "$l_aide_cmd" &>/dev/null; then
      a_aide_conf_files=("$(find -L /etc -type f -name '"'"'aide.conf'"'"')")
      f_file_par_chk()
      {
         a_out2=()
         for l_item in "${a_items[@]}"; do
            ! grep -Psiq -- '"'"'(\h+|\+)'"'"'"$l_item"'"'"'(\h+|\+)'"'"' <<< "$l_out" && \
            a_out2+=("  - Missing the \"$l_item\" option")
         done
         if [ "${#a_out2[@]}" -gt "0" ]; then
            a_output2+=(" - Audit tool file: \"$l_file\"" "${a_out2[@]}")
         else
            a_output+=(" - Audit tool file: \"$l_file\" includes:" " \"${a_items[*]}\"")
         fi
      }
      for l_file in "${a_audit_files[@]}"; do
         if [ -f "$l_tool_dir/$l_file" ]; then
            l_out="$("$l_aide_cmd" --config "${a_aide_conf_files[@]}" -p f:"$l_tool_dir/$l_file")"
            f_file_par_chk
         else
            a_output+=("  - Audit tool file \"$l_file\" doesn'"'"'t exist")
         fi
      done
   else
      a_output2+=("  - The command \"aide\" was not found"  "    Please install AIDE")
   fi
   if [ "${#a_output2[@]}" -le 0 ]; then
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** PASS **" "${a_output[@]}" ""
   else
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** FAIL **" " - Reason(s) for audit failure:" "${a_output2[@]}"
      [ "${#a_output[@]}" -gt 0 ] && printf '"'"'%s\n'"'"' "" "- Correctly set:" "${a_output[@]}" ""
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Run the following command to determine the absolute path to the non-symlinked version on the audit tools: # readlink -f /sbin The output will be either /usr/sbin - OR - /sbin. Ensure the correct path is used. Edit /etc/aide/aide.conf and add or update the following selection lines replacing <PATH> with the correct path returned in the command above: # Audit Tools <PATH>/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 <PATH>/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 <PATH>/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 <PATH>/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 <PATH>/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 Example # printf '%s\n' "" "# Audit Tools" "$(readlink -f /sbin/auditctl) p+i+n+u+g+s+b+acl+xa…

Eigenschaften

Betriebssysteme: ubuntu-26.04
Tags: cis-convertedlinux
Referenz: CIS Ubuntu Linux 26.04 LTS Benchmark v1.0.0 - 6.3.3

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target linux --level 2