Ensure audit configuration files are owned by root

TinggiLevel 2Otomatisfreebsd

Deskripsi

Audit configuration files control auditd and what events are audited. Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Cara pemeriksaan

Metode audit: Perintah shell

shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security -type f -name 'audit*' ! -user root ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Run the following command to change ownership to root user: # find /etc/security -type f -name 'audit*' -user root -exec chown root {} +

Properti

Sistem operasi: Apa saja
Tag: freebsdaudit
Referensi: CIS FreeBSD 14 Benchmark v1.0.1 - 5.2.4.6 Ensure audit configuration files are owned by root

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target freebsd --level 2