Ensure Security Auditing Flags For User-Attributable Events Are Configured Per Local Organizational Requirements

SrednjaNivo 2Automatskamacos

Opis

Auditing is the capture and maintenance of information about security-related events. Auditable events often depend on differing organizational requirements. Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises or attacks that have occurred, have begun, or are about to begin. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Depending on the governing authority, organizations can have vastly different auditing requirements. In this control we have selected a minimal set of audit flags that should be a part of any organizational requirements. The flags selected below may not adequately meet organizational requirements for users of this benchmark. The auditing checks for the flags proposed here will not impact additional flags that are selec...

Kako se proverava

Metod provere: Komanda ljuske

shell

l=$(/usr/bin/grep -e "^flags:" /etc/security/audit_control 2>/dev/null) || exit 1
f=",$(printf '%s' "${l#flags:}" | /usr/bin/tr -d ' '),"
miss=""
for x in aa ad lo; do case "$f" in *",$x,"*) ;; *) miss="$miss $x";; esac; done
case "$f" in
  *",-all,"*|*",all,"*) ;;
  *) for x in ex fm fr fw; do case "$f" in *",-$x,"*|*",$x,"*) ;; *) miss="$miss -$x";; esac; done;;
esac
if [ -z "$miss" ]; then echo compliant; else echo "missing flags:$miss"; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Terminal Method: Perform the following to set the required Security Auditing Flags: Edit the /etc/security/audit_control file and add aa, ad, -ex, -fm, -fr, -fw, and lo to flags. You can also substitute -all for -ex, -fm, -fr, and -fw.

Svojstva

Operativni sistemi: macos-14
Oznake: loggingmacossonoma
Referenca: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 3.2 Ensure Security Auditing Flags For User-Attributable Events Are Configured Per Local Organizational Requirements

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target macos --level 2