Ensure session initiation information is collected

RendahLevel 2Otomatislinux

Deskripsi

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier "session." The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier "logins." Note: • The last command can be used to read /var/log/wtmp (last with no param

Cara pemeriksaan

Metode audit: Perintah shell

shell

alt0() { o=$(bash -c 'grep -E '"'"'(session|logins)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/run/utmp -p wa -k session' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/run/utmp -p wa -k s'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/log/wtmp -p wa -k logins' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/log/wtmp -p wa -k l'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/log/btmp -p wa -k logins' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/log/btmp -p wa -k l'; return 1; }; o=$(bash -c 'auditctl -l | grep -E '"'"'(session|logins)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/run/utmp -p wa -k session' || { echo step2: missing '-w /var/run/utmp -p wa -k session'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/log/wtmp -p wa -k logins' || { echo step2: missing '-w /var/log/wtmp -p wa -k logins'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/log/btmp -p wa -k logins' || { echo step2: missing '-w /var/log/btmp -p wa -k logins'; return 1; }; }; if alt0; then echo compliant; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/session.rules and add the following lines: -w /var/run/utmp -p wa -k session -w /var/log/wtmp -p wa -k logins -w /var/log/btmp -p wa -k logins

Properti

Sistem operasi: sles-12
Tag: cis-convertedlinux
Referensi: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.8

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target linux --level 2