Ensure system is disabled when audit logs are full

RendahLevel 2Otomatislinux

Deskripsi

The auditd daemon can be configured to halt the system when the audit logs are full.

Cara pemeriksaan

Metode audit: Perintah shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep space_left_action /etc/audit/auditd.conf' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'space_left_action = email' || { echo step1: missing 'space_left_action = email'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep action_mail_acct /etc/audit/auditd.conf' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'action_mail_acct = root' || { echo step2: missing 'action_mail_acct = root'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step3: grep not installed"; return 1; }; o=$(bash -c 'grep admin_space_left_action /etc/audit/auditd.conf' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'admin_space_left_action = halt' || { echo step3: missing 'admin_space_left_action = halt'; return 1; }; }; if alt0; then echo compliant; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Set the following parameters in /etc/audit/auditd.conf: space_left_action = email action_mail_acct = root admin_space_left_action = halt

Properti

Sistem operasi: sles-12
Tag: cis-convertedlinux
Referensi: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.2.3

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target linux --level 2