TMA-AIX-4.1.2.4

Ensure access on /audit and /etc/security/audit is configured

보통레벨 1자동aix

설명

This recommendation verifies the access control settings for the default locations of AUDIT configuration and output files. The default location for the AUDIT subsystem configuration files are in /etc/security/audit. The default location for output produced by the audit subsystem is the firectory /audit. Access control must prevent unauthorized access. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

점검 방법

감사 방식: 셸 명령

shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security/audit /audit \( -perm -4 -o -perm -2 -o -perm -1 \) -o ! -user root -o ! -group audit ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Ensure correct ownership and permissions are in place for /etc/security/audit and /audit. #!/usr/bin/ksh -e # Provided to CIS by AIXTools # Copyright AIXTools, 2022 AUDITDIRS="/etc/security/audit /audit" find ${AUDITDIRS} | grep -v 'lost+found' | xargs chown root:audit find ${AUDITDIRS} -type d | grep -v 'lost+found' | xargs chmod g-w,o-rwx find ${AUDITDIRS} ! -type d | grep -v 'lost+found' | xargs chmod -R u-x,g- wx,o-rwx done

속성

운영 체제: 모두
태그: aixaudit
참고 자료: CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.2.4 Ensure access on /audit and /etc/security/audit is configured

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target aix