Linux distributions
TMA-SLES16-6.2.4.8
Ensure audit tools mode is configured
LowLevel 2Automatedlinux
Description
Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
How it is checked
Audit method: Shell command
shell
alt0() { o=$(bash -c '#!/usr/bin/env bash
{
l_output="" l_output2="" l_perm_mask="0022"
l_maxperm="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_perm_mask )) )"
a_audit_tools=("/sbin/auditctl" "/sbin/aureport" "/sbin/ausearch" "/sbin/auditd" "/sbin/augenrules")
for l_audit_tool in "${a_audit_tools[@]}"; do
l_mode="$(stat -Lc '"'"'%#a'"'"' "$l_audit_tool")"
if [ $(( "$l_mode" & "$l_perm_mask" )) -gt 0 ]; then
l_output2="$l_output2\n - Audit tool \"$l_audit_tool\" is mode: \"$l_mode\" and should be mode: \"$l_maxperm\" or more restrictive"
else
l_output="$l_output\n - Audit tool \"$l_audit_tool\" is correctly configured to mode: \"$l_mode\""
fi
done
if [ -z "$l_output2" ]; then
echo -e "\n- Audit Result:\n ** PASS **\n - * Correctly configured * :$l_output"
else
echo -e "\n- Audit Result:\n ** FAIL **\n - * Reasons for audit failure * :$l_output2\n"
[ -n "$l_output" ] && echo -e "\n - * Correctly configured * :\n$l_output\n"
fi
unset a_audit_tools
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Run the following command to remove more permissive mode from the audit tools: # chmod go-w /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/augenrules
Properties
- Operating systems
- sles-16
- Tags
- cis-convertedlinux
- Reference
- CIS SUSE Linux Enterprise 16 Benchmark v1.0.0 - 6.2.4.8
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target linux --level 2