TMAegisBeta
Más reglas para linux

Linux distributions

TMA-SLES16-6.2.4.8

Ensure audit tools mode is configured

BajaNivel 2Automatizadalinux

Descripción

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

Cómo se verifica

Método de auditoría: Comando de shell

shell
alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_output="" l_output2="" l_perm_mask="0022"
   l_maxperm="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_perm_mask )) )"
   a_audit_tools=("/sbin/auditctl" "/sbin/aureport" "/sbin/ausearch" "/sbin/auditd" "/sbin/augenrules")
   for l_audit_tool in "${a_audit_tools[@]}"; do
      l_mode="$(stat -Lc '"'"'%#a'"'"' "$l_audit_tool")"
      if [ $(( "$l_mode" & "$l_perm_mask" )) -gt 0 ]; then
         l_output2="$l_output2\n - Audit tool \"$l_audit_tool\" is mode: \"$l_mode\" and should be mode: \"$l_maxperm\" or more restrictive"
      else
         l_output="$l_output\n - Audit tool \"$l_audit_tool\" is correctly configured to mode: \"$l_mode\""
      fi
   done
   if [ -z "$l_output2" ]; then
      echo -e "\n- Audit Result:\n  ** PASS **\n - * Correctly configured * :$l_output"
   else
      echo -e "\n- Audit Result:\n  ** FAIL **\n - * Reasons for audit failure * :$l_output2\n"
      [ -n "$l_output" ] && echo -e "\n - * Correctly configured * :\n$l_output\n"
   fi
   unset a_audit_tools
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi
Salida esperada
compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following command to remove more permissive mode from the audit tools: # chmod go-w /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/augenrules

Propiedades

Sistemas operativos
sles-16
Etiquetas
cis-convertedlinux
Referencia
CIS SUSE Linux Enterprise 16 Benchmark v1.0.0 - 6.2.4.8

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell
tmaegis scan --target linux --level 2