Ensure session initiation information is collected

BaixaNível 2Automatizadalinux

Descrição

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier "session." The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier "logins." Note: • The last command can be used to read /var/log/wtmp (last with no param

Como é verificado

Método de auditoria: Comando shell

shell

alt0() { o=$(bash -c 'grep -E '"'"'(session|logins)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/run/utmp -p wa -k session' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/run/utmp -p wa -k s'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/log/wtmp -p wa -k logins' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/log/wtmp -p wa -k l'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/session.rules:-w /var/log/btmp -p wa -k logins' || { echo step1: missing '/etc/audit/rules.d/session.rules:-w /var/log/btmp -p wa -k l'; return 1; }; o=$(bash -c 'auditctl -l | grep -E '"'"'(session|logins)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/run/utmp -p wa -k session' || { echo step2: missing '-w /var/run/utmp -p wa -k session'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/log/wtmp -p wa -k logins' || { echo step2: missing '-w /var/log/wtmp -p wa -k logins'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /var/log/btmp -p wa -k logins' || { echo step2: missing '-w /var/log/btmp -p wa -k logins'; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/session.rules and add the following lines: -w /var/run/utmp -p wa -k session -w /var/log/wtmp -p wa -k logins -w /var/log/btmp -p wa -k logins

Propriedades

Sistemas operacionais: sles-12
Tags: cis-convertedlinux
Referência: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.8

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target linux --level 2