Ensure actions as another user are always logged

낮음레벨 2자동linux

설명

sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user.

점검 방법

감사 방식: 셸 명령

shell

alt0() { command -v auditctl >/dev/null 2>&1 || { echo "step1: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep execve' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S ex'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S ex'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep -Ps -- '"'"'execve'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F arch=b64 -S' || { echo step2: missing '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F arch=b32 -S' || { echo step2: missing '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation'; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor elevated privileges. Example: # printf " -a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation -a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation " >> /etc/audit/rules.d/50-user_emulation.rules 2. Merge and load the rules into active configuration: # augenrules --load 3. Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

속성

운영 체제: ubuntu-24.04
태그: cis-convertedlinux
참고 자료: CIS Ubuntu Linux 24.04 LTS Benchmark v2.0.0 - 6.2.3.2

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux --level 2