Ensure changes to system administration scope (sudoers) is collected

FaibleNiveau 2Automatiséelinux

Description

Monitor scope changes for system administrators. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers or a file in the /etc/sudoers.d directory will be written to when the file or its attributes have changed. Note: Reloading the auditd config to set active settings may require a system reboot.

Méthode de vérification

Méthode d'audit: Commande shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep scope /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/scope.rules:-w /etc/sudoers -p wa -k scope' || { echo step1: missing '/etc/audit/rules.d/scope.rules:-w /etc/sudoers -p wa -k scop'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/scope.rules:-w /etc/sudoers.d/ -p wa -k scope' || { echo step1: missing '/etc/audit/rules.d/scope.rules:-w /etc/sudoers.d/ -p wa -k s'; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step2: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep scope' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers -p wa -k scope' || { echo step2: missing '-w /etc/sudoers -p wa -k scope'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers.d -p wa -k scope' || { echo step2: missing '-w /etc/sudoers.d -p wa -k scope'; return 1; }; }; if alt0; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/scope.rules and add the following lines: -w /etc/sudoers -p wa -k scope -w /etc/sudoers.d/ -p wa -k scope

Propriétés

Systèmes d'exploitation: sles-12
Étiquettes: cis-convertedlinux
Référence: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.14

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target linux --level 2