Ensure actions as another user are always logged

FaibleNiveau 2Automatiséelinux

Description

sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user.

Méthode de vérification

Méthode d'audit: Commande shell

shell

alt0() { o=$(bash -c 'awk '"'"'/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&(/ -C *euid!=uid/||/ -C *uid!=euid/) &&/ -S *execve/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S ex'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S ex'; return 1; }; o=$(bash -c 'auditctl -l | awk '"'"'/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&(/ -C *euid!=uid/||/ -C *uid!=euid/) &&/ -S *execve/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing '-a always,exit -F arch=b64 -S execve -C uid!=euid -F auid!=-'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing '-a always,exit -F arch=b32 -S execve -C uid!=euid -F auid!=-'; return 1; }; }; if alt0; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor elevated privileges. Example: # printf " -a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation -a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation " >> /etc/audit/rules.d/50-user_emulation.rules Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Propriétés

Systèmes d'exploitation: ubuntu-20.04
Étiquettes: cis-convertedlinux
Référence: CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 - 6.3.3.2

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target linux --level 2