Ensure session initiation information is collected

低レベル 2自動linux

説明

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier "session." The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier "logins." Note: • The last command can be used to read /var/log/wtmp (last with no param

チェック方法

監査方法: シェルコマンド

shell

alt0() { o=$(bash -c 'grep -E '"'"'(session|logins)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/run/utmp -p wa -k session' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/run/utmp -p wa -k s'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/log/wtmp -p wa -k logins' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/log/wtmp -p wa -k l'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/log/btmp -p wa -k logins' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/log/btmp -p wa -k l'; return 1; }; o=$(bash -c 'auditctl -l | grep -E '"'"'(session|logins)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/run/utmp -p wa -k session' || { echo step2: missing '-w /var/run/utmp -p wa -k session'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/log/wtmp -p wa -k logins' || { echo step2: missing '-w /var/log/wtmp -p wa -k logins'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/log/btmp -p wa -k logins' || { echo step2: missing '-w /var/log/btmp -p wa -k logins'; return 1; }; }; if alt0; then echo compliant; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/session.rules and add the following lines: -w /var/run/utmp -p wa -k session -w /var/log/wtmp -p wa -k logins -w /var/log/btmp -p wa -k logins

プロパティ

オペレーティングシステム: sles-12
タグ: cis-convertedlinux
参照: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.8

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target linux --level 2