Ensure audit configuration files belong to group wheel

SedangLevel 2Otomatisfreebsd

Deskripsi

Audit configuration files control auditd and what events are audited. Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Cara pemeriksaan

Metode audit: Perintah shell

shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security -type f -name 'audit*' ! -group wheel ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Run the following command to change group to wheel: # find /etc/security -type f -name 'audit*' ! -group wheel chgrp wheel {} +

Properti

Sistem operasi: Apa saja
Tag: freebsdaudit
Referensi: CIS FreeBSD 14 Benchmark v1.0.1 - 5.2.4.7 Ensure audit configuration files belong to group wheel

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target freebsd --level 2