Ensure modification to TE system is audited

MoyenneNiveau 1Automatiséeaix

Description

At Level 1, Trusted Execution (TE) should be actively monitoring for applications not yet allowlisted. The recommendation for this is in section two. Additionally, the AIX AUDIT system needs to be configured for modifications to the TE subsystem. Modification to security mechanisms need to be monitored to maintain system integrity. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(grep -E "^[[:blank:]]*default[[:blank:]]*=" /etc/security/audit/config 2>/dev/null) || exit 1; r=compliant; for p in '(=|,)[[:blank:]]*TE_Untrusted([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_FileWrite([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_Policies([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEAdd_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEDel_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TESwitch_algo([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEQuery_Stnz([[:blank:]]*,|[[:blank:]]*$)'; do printf '%s\n' "$out" | grep -Eq -- "$p" || r="missing: $p"; done; echo "$r"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Ensure AUDIT Trusted Execution events are in the class default. 1. Edit the file /etc/security/audit/config 2. Find the stanza named classes: 3. If the class default does not exist add a line with: default = TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz 4. If the class default already exists ensure the following audit events are included in the class definition TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: aixaudit
Référence: CIS IBM AIX 7 Benchmark v1.2.0 - 8.1.3 Ensure modification to TE system is audited

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target aix