Ensure modification to TE system is audited

SedangLevel 1Otomatisaix

Deskripsi

At Level 1, Trusted Execution (TE) should be actively monitoring for applications not yet allowlisted. The recommendation for this is in section two. Additionally, the AIX AUDIT system needs to be configured for modifications to the TE subsystem. Modification to security mechanisms need to be monitored to maintain system integrity. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Cara pemeriksaan

Metode audit: Perintah shell

shell

out=$(grep -E "^[[:blank:]]*default[[:blank:]]*=" /etc/security/audit/config 2>/dev/null) || exit 1; r=compliant; for p in '(=|,)[[:blank:]]*TE_Untrusted([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_FileWrite([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_Policies([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEAdd_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEDel_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TESwitch_algo([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEQuery_Stnz([[:blank:]]*,|[[:blank:]]*$)'; do printf '%s\n' "$out" | grep -Eq -- "$p" || r="missing: $p"; done; echo "$r"

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Ensure AUDIT Trusted Execution events are in the class default. 1. Edit the file /etc/security/audit/config 2. Find the stanza named classes: 3. If the class default does not exist add a line with: default = TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz 4. If the class default already exists ensure the following audit events are included in the class definition TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz

Properti

Sistem operasi: Apa saja
Tag: aixaudit
Referensi: CIS IBM AIX 7 Benchmark v1.2.0 - 8.1.3 Ensure modification to TE system is audited

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target aix