Ensure audit tools owner is configured

BajaNivel 2Automatizadalinux

Descripción

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

Cómo se verifica

Método de auditoría: Comando de shell

shell

alt0() { command -v awk >/dev/null 2>&1 || { echo "step1: awk not installed"; return 1; }; command -v stat >/dev/null 2>&1 || { echo "step1: stat not installed"; return 1; }; o=$(bash -c 'stat -Lc "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules | awk '"'"'$2 != "root" {print}'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following command to change the owner of the audit tools to the root user: # chown root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules

Propiedades

Sistemas operativos: rocky-10
Etiquetas: cis-convertedlinux
Referencia: CIS Rocky Linux 10 Benchmark v1.0.0 - 6.3.4.9

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target linux --level 2