Ensure audit tools group owner is configured

BajaNivel 2Automatizadalinux

Descripción

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

Cómo se verifica

Método de auditoría: Comando de shell

shell

alt0() { command -v awk >/dev/null 2>&1 || { echo "step1: awk not installed"; return 1; }; command -v stat >/dev/null 2>&1 || { echo "step1: stat not installed"; return 1; }; o=$(bash -c 'stat -Lc "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/augenrules | awk '"'"'$2 != "root" {print}'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following command to change group ownership to the group root: # chgrp root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/augenrules

Propiedades

Sistemas operativos: sles-16
Etiquetas: cis-convertedlinux
Referencia: CIS SUSE Linux Enterprise 16 Benchmark v1.0.0 - 6.2.4.10

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target linux --level 2