Ensure events that modify the sudo log file are collected

ÉlevéeNiveau 2Automatiséefreebsd

Description

Monitor the sudo log file. If the system has been properly configured to disable the use of the su command and force all administrators to have to log in first and then use sudo to execute privileged commands, then all administrator commands will be logged to /var/log/sudo.log. Changes in /var/log/sudo.log indicate that an administrator has executed a command or the log file itself has been tampered with. Audit: the global flags: line in /etc/security/audit_control must include fa,fc,fd,fm,fr,fw.

Méthode de vérification

Méthode d'audit: Commande shell

shell

l=$(grep "^flags:" /etc/security/audit_control 2>/dev/null) || exit 1; f=",${l#flags:},"; r=compliant; for c in fa fc fd fm fr fw; do case "$f" in *,$c,*|*,+$c,*) ;; *) r="flags missing $c";; esac; done; echo "$r"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Add the classes fa,fc,fd,fm,fr,fw to the flags: line in /etc/security/audit_control, then run audit -s.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: freebsdaudit
Référence: CIS FreeBSD 14 Benchmark v1.0.1 - 5.2.3.2 Ensure events that modify the sudo log file are collected

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target freebsd --level 2