Ensure actions as another user are always logged

LowLevel 2Automatedlinux

Description

sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user.

How it is checked

Audit method: Shell command

shell

alt0() { o=$(bash -c 'awk '"'"'/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&(/ -C *euid!=uid/||/ -C *uid!=euid/) &&/ -S *execve/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S ex'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S ex'; return 1; }; o=$(bash -c 'auditctl -l | awk '"'"'/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&(/ -C *euid!=uid/||/ -C *uid!=euid/) &&/ -S *execve/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing '-a always,exit -F arch=b64 -S execve -C uid!=euid -F auid!=-'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing '-a always,exit -F arch=b32 -S execve -C uid!=euid -F auid!=-'; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor elevated privileges. Example: # printf " -a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation -a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation " >> /etc/audit/rules.d/50-user_emulation.rules Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Properties

Operating systems: sles-15
Tags: cis-convertedlinux
Reference: CIS SUSE Linux Enterprise 15 Benchmark v2.0.1 - 6.3.3.2

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux --level 2