Ensure /audit filesystem has been created and configured

Como é verificado

Método de auditoria: Comando shell

command -v lsfs >/dev/null 2>&1 || exit 1; command -v lssec >/dev/null 2>&1 || exit 1; command -v lsitab >/dev/null 2>&1 || exit 1; r=compliant; lsfs /audit >/dev/null 2>&1 || r="Audit Filesystem is missing"; a=$(lssec -f /usr/lib/security/mkuser.default -s user -a auditclasses 2>/dev/null); [ "$a" = "user auditclasses=general,SRC,cron,tcpip" ] || r="mkuser.default: $a"; crontab -l 2>/dev/null | grep -q cronaudit || r="cronaudit cron job missing"; lsitab audit >/dev/null 2>&1 || r="audit inittab entry missing"; echo "$r"

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Configure AIX auditing in-line with the High Level AIX Security Expert policy. Create a /audit filesystem, at least 100 MB in size: mklv -y <LV name> -t jfs2 -u 1 -c 1 rootvg 1 hdisk0 crfs -v jfs2 -d <LV name> -m /audit -A yes -t no mount /audit Reflect the following configuration in the /etc/security/audit/config file: vi /etc/security/audit/config Add in: start: binmode = on streammode = off bin: trail = /audit/trail bin1 = /audit/bin1 bin2 = /audit/bin2 binsize = 10240 cmds = /etc/security/audit/bincmds Add the auditing entries for root and all other users below the pre-defined audit classes: users: root = general,SRC,mail,cron,tcpip,ipsec,lvm <user 1> = general,SRC,cron,tcpip <user 2> = general,SRC,cron,tcpip etc. Update the /usr/lib/security/mkuser.default auditclasses entry to ensure that auditing is set up for any newly created users: chsec -f /usr/lib/security/mkuser.default -s user -a auditclasses=general,SRC,cron,tcpip A cron job is implemented to monitor the free space in /audit, running hourly, to ensure that /audit does not fill up. If /audit is greater than 90% used, /audit/trail is moved to /audit/trailOneLevelBack: crontab -e Add in: 0 * ... (see CIS section 8.1.1)

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target aix --level 2