Ensure changes to system administration scope (sudoers) is collected

НискаНиво 2Аутоматскаlinux

Опис

Monitor scope changes for system administrators. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers or a file in the /etc/sudoers.d directory will be written to when the file or its attributes have changed. Note: Reloading the auditd config to set active settings may require a system reboot.

Како се проверава

Метод провере: Команда љуске

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep scope /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/scope.rules:-w /etc/sudoers -p wa -k scope' || { echo step1: missing '/etc/audit/rules.d/scope.rules:-w /etc/sudoers -p wa -k scop'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/scope.rules:-w /etc/sudoers.d/ -p wa -k scope' || { echo step1: missing '/etc/audit/rules.d/scope.rules:-w /etc/sudoers.d/ -p wa -k s'; return 1; }; command -v auditctl >/dev/null 2>&1 || { echo "step2: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep scope' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers -p wa -k scope' || { echo step2: missing '-w /etc/sudoers -p wa -k scope'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-w /etc/sudoers.d -p wa -k scope' || { echo step2: missing '-w /etc/sudoers.d -p wa -k scope'; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules Example: vi /etc/audit/rules.d/scope.rules and add the following lines: -w /etc/sudoers -p wa -k scope -w /etc/sudoers.d/ -p wa -k scope

Својства

Оперативни системи: sles-12
Ознаке: cis-convertedlinux
Референца: CIS SUSE Linux Enterprise 12 Benchmark v3.2.0 - 4.1.14

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target linux --level 2