Ensure events that modify the sudo log file are collected

HighLevel 2Automatedfreebsd

Description

Monitor the sudo log file. If the system has been properly configured to disable the use of the su command and force all administrators to have to log in first and then use sudo to execute privileged commands, then all administrator commands will be logged to /var/log/sudo.log. Changes in /var/log/sudo.log indicate that an administrator has executed a command or the log file itself has been tampered with. Audit: the global flags: line in /etc/security/audit_control must include fa,fc,fd,fm,fr,fw.

How it is checked

Audit method: Shell command

shell

l=$(grep "^flags:" /etc/security/audit_control 2>/dev/null) || exit 1; f=",${l#flags:},"; r=compliant; for c in fa fc fd fm fr fw; do case "$f" in *,$c,*|*,+$c,*) ;; *) r="flags missing $c";; esac; done; echo "$r"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Add the classes fa,fc,fd,fm,fr,fw to the flags: line in /etc/security/audit_control, then run audit -s.

Properties

Operating systems: Any
Tags: freebsdaudit
Reference: CIS FreeBSD 14 Benchmark v1.0.1 - 5.2.3.2 Ensure events that modify the sudo log file are collected

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target freebsd --level 2