Ensure only authorized groups are assigned ownership of audit log files

ВисокаНиво 2Аутоматскаfreebsd

Опис

Audit log files contain information about the system and system activity. Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Како се проверава

Метод провере: Команда љуске

shell

command -v find >/dev/null 2>&1 || exit 1; d=$(awk -F: '/^dir:/ {print $2; exit}' /etc/security/audit_control 2>/dev/null); [ -n "$d" ] && [ -d "$d" ] || exit 1; out=$( { find "$d" -type f ! -group wheel ! -group audit -exec stat -Lf "%N %Sg" {} + ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Run the following command to configure the audit log files to be owned by the audit group: # chgrp audit /var/audit

Својства

Оперативни системи: Било који
Ознаке: freebsdaudit
Референца: CIS FreeBSD 14 Benchmark v1.0.1 - 5.2.4.4 Ensure only authorized groups are assigned ownership of audit log files

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target freebsd --level 2