Ensure changes to system administration scope (sudoers) is collected

RendahLevel 2Otomatislinux

Deskripsi

Monitor scope changes for system administrators. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers or a file in the /etc/sudoers.d directory will be written to when the file or its attributes have changed. Note: Reloading the auditd config to set active settings may require a system reboot.

Cara pemeriksaan

Metode audit: Perintah shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep scope /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/scope.rules:-w /etc/sudoers -p wa -k scope' || { echo step1: missing '/etc/audit/rules.d/scope.rules:-w /etc/sudoers -p wa -k scop'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/scope.rules:-w /etc/sudoers.d/ -p wa -k scope' || { echo step1: missing '/etc/audit/rules.d/scope.rules:-w /etc/sudoers.d/ -p wa -k s'; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step2: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep scope' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers -p wa -k scope' || { echo step2: missing '-w /etc/sudoers -p wa -k scope'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers.d -p wa -k scope' || { echo step2: missing '-w /etc/sudoers.d -p wa -k scope'; return 1; }; }; if alt0; then echo compliant; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/scope.rules and add the following lines: -w /etc/sudoers -p wa -k scope -w /etc/sudoers.d/ -p wa -k scope

Properti

Sistem operasi: sles-12
Tag: cis-convertedlinux
Referensi: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.14

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target linux --level 2