Ensure changes to system administration scope (sudoers) is collected

НискаНиво 2Аутоматскаlinux

Опис

Monitor scope changes for system administrators. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers, or files in /etc/sudoers.d, will be written to when the file(s) or related attributes have changed. The audit records will be tagged with the identifier "scope".

Како се проверава

Метод провере: Команда љуске

shell

alt0() { o=$(bash -c 'awk '"'"'/^ *-w/ &&/\/etc\/sudoers/ &&/ +-p *wa/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers -p wa -k scope' || { echo step1: missing '-w /etc/sudoers -p wa -k scope'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers.d -p wa -k scope' || { echo step1: missing '-w /etc/sudoers.d -p wa -k scope'; return 1; }; o=$(bash -c 'auditctl -l | awk '"'"'/^ *-w/ &&/\/etc\/sudoers/ &&/ +-p *wa/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers -p wa -k scope' || { echo step2: missing '-w /etc/sudoers -p wa -k scope'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers.d -p wa -k scope' || { echo step2: missing '-w /etc/sudoers.d -p wa -k scope'; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor scope changes for system administrators. Example: # printf '%s\n' "-w /etc/sudoers -p wa -k scope" "-w /etc/sudoers.d -p wa -k scope" >> /etc/audit/rules.d/50-scope.rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Својства

Оперативни системи: rocky-8
Ознаке: cis-convertedlinux
Референца: CIS Rocky Linux 8 Benchmark v3.0.0 - 6.3.3.1

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target linux --level 2