Ensure modification to TE system is audited

СреднийУровень 1Автоматическаяaix

Описание

At Level 1, Trusted Execution (TE) should be actively monitoring for applications not yet allowlisted. The recommendation for this is in section two. Additionally, the AIX AUDIT system needs to be configured for modifications to the TE subsystem. Modification to security mechanisms need to be monitored to maintain system integrity. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Как проверяется

Метод проверки: Команда оболочки

shell

out=$(grep -E "^[[:blank:]]*default[[:blank:]]*=" /etc/security/audit/config 2>/dev/null) || exit 1; r=compliant; for p in '(=|,)[[:blank:]]*TE_Untrusted([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_FileWrite([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TE_Policies([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEAdd_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEDel_Stnz([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TESwitch_algo([[:blank:]]*,|[[:blank:]]*$)' '(=|,)[[:blank:]]*TEQuery_Stnz([[:blank:]]*,|[[:blank:]]*$)'; do printf '%s\n' "$out" | grep -Eq -- "$p" || r="missing: $p"; done; echo "$r"

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Ensure AUDIT Trusted Execution events are in the class default. 1. Edit the file /etc/security/audit/config 2. Find the stanza named classes: 3. If the class default does not exist add a line with: default = TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz 4. If the class default already exists ensure the following audit events are included in the class definition TE_Untrusted,TE_FileWrite,TE_Policies,TEAdd_Stnz,TEDel_Stnz,TESwitch_algo,TEQ uery_Stnz

Свойства

Операционные системы: Любая
Теги: aixaudit
Источник: CIS IBM AIX 7 Benchmark v1.2.0 - 8.1.3 Ensure modification to TE system is audited

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target aix