Ensure actions as another user are always logged

BajaNivel 2Automatizadalinux

Descripción

sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user.

Cómo se verifica

Método de auditoría: Comando de shell

shell

alt0() { command -v auditctl >/dev/null 2>&1 || { echo "step1: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep execve' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S ex'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S ex'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep -Ps -- '"'"'execve'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F arch=b64 -S' || { echo step2: missing '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F arch=b32 -S' || { echo step2: missing '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation'; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor elevated privileges. Example: # printf " -a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation -a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation " >> /etc/audit/rules.d/50-user_emulation.rules 2. Merge and load the rules into active configuration: # augenrules --load 3. Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Propiedades

Sistemas operativos: ubuntu-24.04
Etiquetas: cis-convertedlinux
Referencia: CIS Ubuntu Linux 24.04 LTS Benchmark v2.0.0 - 6.2.3.2

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target linux --level 2