Linux distributions
TMA-SLES16-6.2.4.8
Ensure audit tools mode is configured
BajaNivel 2Automatizadalinux
Descripción
Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Cómo se verifica
Método de auditoría: Comando de shell
shell
alt0() { o=$(bash -c '#!/usr/bin/env bash
{
l_output="" l_output2="" l_perm_mask="0022"
l_maxperm="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_perm_mask )) )"
a_audit_tools=("/sbin/auditctl" "/sbin/aureport" "/sbin/ausearch" "/sbin/auditd" "/sbin/augenrules")
for l_audit_tool in "${a_audit_tools[@]}"; do
l_mode="$(stat -Lc '"'"'%#a'"'"' "$l_audit_tool")"
if [ $(( "$l_mode" & "$l_perm_mask" )) -gt 0 ]; then
l_output2="$l_output2\n - Audit tool \"$l_audit_tool\" is mode: \"$l_mode\" and should be mode: \"$l_maxperm\" or more restrictive"
else
l_output="$l_output\n - Audit tool \"$l_audit_tool\" is correctly configured to mode: \"$l_mode\""
fi
done
if [ -z "$l_output2" ]; then
echo -e "\n- Audit Result:\n ** PASS **\n - * Correctly configured * :$l_output"
else
echo -e "\n- Audit Result:\n ** FAIL **\n - * Reasons for audit failure * :$l_output2\n"
[ -n "$l_output" ] && echo -e "\n - * Correctly configured * :\n$l_output\n"
fi
unset a_audit_tools
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Run the following command to remove more permissive mode from the audit tools: # chmod go-w /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/augenrules
Propiedades
- Sistemas operativos
- sles-16
- Etiquetas
- cis-convertedlinux
- Referencia
- CIS SUSE Linux Enterprise 16 Benchmark v1.0.0 - 6.2.4.8
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target linux --level 2