Ensure modification to TE system is audited

中レベル 1自動aix

説明

At Level 1, Trusted Execution (TE) should be actively monitoring for applications not yet allowlisted. The recommendation for this is in section two. Additionally, the AIX AUDIT system needs to be configured for modifications to the TE subsystem. Modification to security mechanisms need to be monitored to maintain system integrity. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

チェック方法

監査方法: シェルコマンド

shell

out=$(grep -E "^[[:blank:]]*default[[:blank:]]*=" /etc/security/audit/config 2>/dev/null) || exit 1; r=compliant; for p in '(=|,)[[:blank:]]*TE_Untrusted([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_FileWrite([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_Policies([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEAdd_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEDel_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TESwitch_algo([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEQuery_Stnz([[:blank:]]*,|[[:blank:]]*$)'; do printf '%s\n' "$out" | grep -Eq -- "$p" || r="missing: $p"; done; echo "$r"

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Ensure AUDIT Trusted Execution events are in the class default. 1. Edit the file /etc/security/audit/config 2. Find the stanza named classes: 3. If the class default does not exist add a line with: default = TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz 4. If the class default already exists ensure the following audit events are included in the class definition TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz

プロパティ

オペレーティングシステム: すべて
タグ: aixaudit
参照: CIS IBM AIX 7 Benchmark v1.2.0 - 8.1.3 Ensure modification to TE system is audited

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target aix