Ensure events that modify user/group information are collected

BaixaNível 2Automatizadalinux

Descrição

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier "identity" in the audit log file. Note: Reloading the auditd config to set active settings may require a system reboot.

Como é verificado

Método de auditoria: Comando shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep identity /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/identity.rules:-w /etc/group -p wa -k identity' || { echo step1: missing '/etc/audit/rules.d/identity.rules:-w /etc/group -p wa -k ide'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/identity.rules:-w /etc/passwd -p wa -k identity' || { echo step1: missing '/etc/audit/rules.d/identity.rules:-w /etc/passwd -p wa -k id'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/identity.rules:-w /etc/shadow -p wa -k identity' || { echo step1: missing '/etc/audit/rules.d/identity.rules:-w /etc/shadow -p wa -k id'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/identity.rules:-w /etc/security/opasswd -p wa -k identity' || { echo step1: missing '/etc/audit/rules.d/identity.rules:-w /etc/security/opasswd -'; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step2: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep identity' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/group -p wa -k identity' || { echo step2: missing '-w /etc/group -p wa -k identity'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/passwd -p wa -k identity' || { echo step2: missing '-w /etc/passwd -p wa -k identity'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/shadow -p wa -k identity' || { echo step2: missing '-w /etc/shadow -p wa -k identity'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/security/opasswd -p wa -k identity' || { echo step2: missing '-w /etc/security/opasswd -p wa -k identity'; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/identity.rules and add the following lines: -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identity

Propriedades

Sistemas operacionais: sles-12
Tags: cis-convertedlinux
Referência: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.4

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target linux --level 2