Enable Auditing of Incoming Network Connections

中レベル 1自動solaris

説明

The Solaris Audit service can be configured to record incoming network connections to any listening service running on the system. This recommendation will provide an audit trail that contains information related to incoming network connections. Audit: each listed event must carry the cis class in /etc/security/audit_event.

チェック方法

監査方法: シェルコマンド

shell

[ -r /etc/security/audit_event ] || exit 1; r=compliant; for e in AUE_ACCEPT AUE_CONNECT AUE_SOCKACCEPT AUE_SOCKCONNECT AUE_inetd_connect; do awk -F: -v e="$e" '$2==e && $4 ~ /(^|,)cis(,|$)/ {f=1} END {exit !f}' /etc/security/audit_event || r="$e not assigned to the cis class"; done; echo "$r"

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

To enforce this setting, run the following commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # cp /etc/security/audit_event /etc/security/audit_event.orig # awk 'BEGIN{FS=":"; OFS=":"} {if ($2 ~ /AUE_ACCEPT|AUE_CONNECT|AUE_SOCKACCEPT|AUE_SOCKCONNECT|AUE_inetd_connect/) $4=$4",cis";} {print} ' /etc/security/audit_event > /etc/security/audit_event.out # cp /etc/security/audit_event.out /etc/security/audit_event

プロパティ

オペレーティングシステム: すべて
タグ: solarisaudit
参照: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 4.2 Enable Auditing of Incoming Network Connections

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target solaris