Ensure audit_backlog_limit is configured

低レベル 2自動linux

説明

In the kernel-level audit subsystem, a socket buffer queue is used to hold audit events. Whenever a new audit event is received, it is logged and prepared to be added to this queue. The kernel boot parameter audit_backlog_limit=N, with N representing the amount of messages, will ensure that a queue cannot grow beyond a certain size. If an audit event is logged which would grow the queue beyond this limit, then a failure occurs and is handled according to the system configuration

チェック方法

監査方法: シェルコマンド

shell

alt0() { command -v find >/dev/null 2>&1 || { echo "step1: find not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'find /boot -type f -name '"'"'grub.cfg'"'"' -exec grep -Ph -- '"'"'^\h*linux'"'"' {} + | grep -Pv '"'"'audit_backlog_limit=\d+\b'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Edit /etc/default/grub and add audit_backlog_limit=N to GRUB_CMDLINE_LINUX. The recommended size for N is 8192 or larger. Example: GRUB_CMDLINE_LINUX="audit_backlog_limit=8192" Run the following command to update the grub2 configuration: # update-grub

プロパティ

オペレーティングシステム: ubuntu-20.04
タグ: cis-convertedlinux
参照: CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 - 6.3.1.4

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target linux --level 2