Ensure audit log files group owner is configured

낮음레벨 2자동linux

설명

Audit log files contain information about the system and system activity.

점검 방법

감사 방식: 셸 명령

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_output="" l_output2=""
   if [ -e "/etc/audit/auditd.conf" ]; then
      l_audit_log_directory="$(dirname "$(awk -F= '"'"'/^\s*log_file\s*/{print $2}'"'"' /etc/audit/auditd.conf | xargs)")"
      l_audit_log_group="$(awk -F= '"'"'/^\s*log_group\s*/{print $2}'"'"' /etc/audit/auditd.conf | xargs)"
      if grep -Pq -- '"'"'^\h*(root|adm)\h*$'"'"' <<< "$l_audit_log_group"; then
         l_output="$l_output\n  - Log file group correctly set to: \"$l_audit_log_group\" in \"/etc/audit/auditd.conf\""
      else
         l_output2="$l_output2\n  - Log file group is set to: \"$l_audit_log_group\" in \"/etc/audit/auditd.conf\"\n     (should be set to group: \"root or adm\")\n"
      fi
      if [ -d "$l_audit_log_directory" ]; then
         while IFS= read -r -d $'"'"'\0'"'"' l_file; do
            l_output2="$l_output2\n  - File: \"$l_file\" is group owned by group: \"$(stat -Lc '"'"'%G'"'"' "$l_file")\"\n     (should be group owned by group: \"root or adm\")\n"
         done < <(find "$l_audit_log_directory" -maxdepth 1 -type f \( ! -group root -a ! -group adm \) - print0)
      else
         l_output2="$l_output2\n  - Log file directory not set in \"/etc/audit/auditd.conf\" please set log file directory"
      fi
   else
      l_output2="$l_output2\n  - File: \"/etc/audit/auditd.conf\" not found.\n  - ** Verify auditd is installed **"
   fi
   if [ -z "$l_output2" ]; then
      l_output="$l_output\n  - All files in \"$l_audit_log_directory\" are group owned by group: \"root or adm\"\n"
      echo -e "\n- Audit Result:\n  ** PASS **\n - * Correctly configured * :$l_output"
   else
      echo -e "\n- Audit Result:\n  ** FAIL **\n - * Reasons for audit failure * :$l_output2\n"
      [ -n "$l_output" ] && echo -e " - * Correctly configured * :\n$l_output\n"
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run the following command to configure the audit log files to be owned by adm group: # find $(dirname $(awk -F"=" '/^\s*log_file\s*=\s*/ {print $2}' /etc/audit/auditd.conf | xargs)) -type f $ ! -group adm -a ! -group root $ -exec chgrp adm {} + Run the following command to configure the audit log files to be owned by the adm group: # chgrp adm /var/log/audit/ Run the following command to set the log_group parameter in the audit configuration file to log_group = adm: # sed -ri 's/^\s*#?\s*log_group\s*=\s*\S+(\s*#.*)?.*$/log_group = adm\1/' /etc/audit/auditd.conf Run the following command to restart the audit daemon to reload the configuration file: # systemctl restart auditd

속성

운영 체제: rocky-10
태그: cis-convertedlinux
참고 자료: CIS Rocky Linux 10 Benchmark v1.0.0 - 6.3.4.4

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux --level 2