Enable Auditing of Process and Privilege Events

ВисокаНиво 1Аутоматскаsolaris

Опис

The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these. Audit: each listed event must carry the cis class in /etc/security/audit_event.

Како се проверава

Метод провере: Команда љуске

shell

[ -r /etc/security/audit_event ] || exit 1; r=compliant; for e in AUE_CHROOT AUE_SETREUID AUE_SETREGID AUE_FCHROOT AUE_PFEXEC AUE_SETUID AUE_NICE AUE_SETGID AUE_PRIOCNTLSYS AUE_SETEGID AUE_SETEUID AUE_SETPPRIV AUE_SETSID AUE_SETPGID; do awk -F: -v e="$e" '$2==e && $4 ~ /(^|,)cis(,|$)/ {f=1} END {exit !f}' /etc/security/audit_event || r="$e not assigned to the cis class"; done; echo "$r"

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

To enforce this setting, run the following commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=":"; OFS=":"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4",cis";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event

Својства

Оперативни системи: Било који
Ознаке: solarisaudit
Референца: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 4.4 Enable Auditing of Process and Privilege Events

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target solaris