Ensure auditing for processes that start prior to auditd is enabled

RendahLevel 2Otomatislinux

Deskripsi

Configure grub2 so that processes that are capable of being audited can be audited even if they start up prior to auditd startup.

Cara pemeriksaan

Metode audit: Perintah shell

shell

alt0() { command -v find >/dev/null 2>&1 || { echo "step1: find not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'find /boot -type f -name '"'"'grub.cfg'"'"' -exec grep -Ph -- '"'"'^\h*linux'"'"' {} + | grep -v '"'"'audit=1'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX: Example: GRUB_CMDLINE_LINUX="audit=1" Run the following command to update the grub2 configuration: # update-grub

Properti

Sistem operasi: ubuntu-20.04
Tag: cis-convertedlinux
Referensi: CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 - 6.3.1.3

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target linux --level 2