Linux distributions
TMA-SLES16-6.2.4.8
Ensure audit tools mode is configured
НискаНиво 2Аутоматскаlinux
Опис
Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Како се проверава
Метод провере: Команда љуске
shell
alt0() { o=$(bash -c '#!/usr/bin/env bash
{
l_output="" l_output2="" l_perm_mask="0022"
l_maxperm="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_perm_mask )) )"
a_audit_tools=("/sbin/auditctl" "/sbin/aureport" "/sbin/ausearch" "/sbin/auditd" "/sbin/augenrules")
for l_audit_tool in "${a_audit_tools[@]}"; do
l_mode="$(stat -Lc '"'"'%#a'"'"' "$l_audit_tool")"
if [ $(( "$l_mode" & "$l_perm_mask" )) -gt 0 ]; then
l_output2="$l_output2\n - Audit tool \"$l_audit_tool\" is mode: \"$l_mode\" and should be mode: \"$l_maxperm\" or more restrictive"
else
l_output="$l_output\n - Audit tool \"$l_audit_tool\" is correctly configured to mode: \"$l_mode\""
fi
done
if [ -z "$l_output2" ]; then
echo -e "\n- Audit Result:\n ** PASS **\n - * Correctly configured * :$l_output"
else
echo -e "\n- Audit Result:\n ** FAIL **\n - * Reasons for audit failure * :$l_output2\n"
[ -n "$l_output" ] && echo -e "\n - * Correctly configured * :\n$l_output\n"
fi
unset a_audit_tools
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi- Очекивани излаз
compliant
Како се исправља
Метод исправке: Смерница или закрпа инфраструктуре
Run the following command to remove more permissive mode from the audit tools: # chmod go-w /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/augenrules
Својства
- Оперативни системи
- sles-16
- Ознаке
- cis-convertedlinux
- Референца
- CIS SUSE Linux Enterprise 16 Benchmark v1.0.0 - 6.2.4.8
Проверите овај рачунар
Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.
shell
tmaegis scan --target linux --level 2