Configure Solaris Auditing

MoyenneNiveau 1Automatiséesolaris

Description

Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. Audit: checks audit condition, active policies (argv,cnt,zonename), user default flags (ad,ft,lo,ex,cis), non-attributable flags (lo), the audit_binfile plugin and root audit_flags; confirm the audit trail is growing manually.

Méthode de vérification

Méthode d'audit: Commande shell

shell

command -v auditconfig >/dev/null 2>&1 || exit 1; command -v userattr >/dev/null 2>&1 || exit 1; r=compliant; auditconfig -getcond 2>/dev/null | grep -q "audit condition = auditing" || r="auditing is not active"; p=$(auditconfig -getpolicy 2>/dev/null | grep "^active audit policies"); for x in argv cnt zonename; do printf '%s\n' "$p" | grep -Eq "[=,][[:blank:]]*$x(,|$)" || r="policy $x not active"; done; fl=$(auditconfig -getflags 2>/dev/null | grep "^active user default audit flags"); for x in ad ft lo ex cis; do printf '%s\n' "$fl" | grep -Eq "[=,][[:blank:]]*$x[,(]" || r="audit flag $x not active"; done; auditconfig -getnaflags 2>/dev/null | grep "^active non-attributable audit flags" | grep -Eq "= *lo\(" || r="non-attributable flags are not lo"; auditconfig -getplugin audit_binfile 2>/dev/null | grep -q "audit_binfile (active)" || r="audit_binfile plugin not active"; userattr audit_flags root 2>/dev/null | grep -Eq "^lo,ad,ft,ex,cis:no$" || r="root audit_flags not lo,ad,ft,ex,cis:no"; echo "$r"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

To enforce this setting, run the following commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/share/audit # chmod 750 /var/share/audit

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: solarisaudit
Référence: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 4.5 Configure Solaris Auditing

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target solaris