Ensure access on /audit and /etc/security/audit is configured

SrednjaNivo 1Automatskaaix

Opis

This recommendation verifies the access control settings for the default locations of AUDIT configuration and output files. The default location for the AUDIT subsystem configuration files are in /etc/security/audit. The default location for output produced by the audit subsystem is the firectory /audit. Access control must prevent unauthorized access. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Kako se proverava

Metod provere: Komanda ljuske

shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security/audit /audit \( -perm -4 -o -perm -2 -o -perm -1 \) -o ! -user root -o ! -group audit ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Ensure correct ownership and permissions are in place for /etc/security/audit and /audit. #!/usr/bin/ksh -e # Provided to CIS by AIXTools # Copyright AIXTools, 2022 AUDITDIRS="/etc/security/audit /audit" find ${AUDITDIRS} | grep -v 'lost+found' | xargs chown root:audit find ${AUDITDIRS} -type d | grep -v 'lost+found' | xargs chmod g-w,o-rwx find ${AUDITDIRS} ! -type d | grep -v 'lost+found' | xargs chmod -R u-x,g- wx,o-rwx done

Svojstva

Operativni sistemi: Bilo koji
Oznake: aixaudit
Referenca: CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.2.4 Ensure access on /audit and /etc/security/audit is configured

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target aix