Ensure session initiation information is collected

NiskaNivo 2Automatskalinux

Opis

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. • /var/run/utmp - tracks all currently logged in users. • /var/log/wtmp - file tracks logins, logouts, shutdown, and reboot events. • /var/log/btmp - keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp. All audit records will be tagged with the identifier "session."

Kako se proverava

Metod provere: Komanda ljuske

shell

alt0() { o=$(bash -c 'auditctl -l | grep -Ps -- '"'"'(\/var\/run\/utmp|\/var\/log\/wtmp|\/var\/log\/btmp)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F path=/var/run/utmp -F perm=wa' || { echo step1: missing '-a always,exit -F path=/var/run/utmp -F perm=wa'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F path=/var/log/wtmp -F perm=wa' || { echo step1: missing '-a always,exit -F path=/var/log/wtmp -F perm=wa'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F path=/var/log/btmp -F perm=wa' || { echo step1: missing '-a always,exit -F path=/var/log/btmp -F perm=wa'; return 1; }; o=$(bash -c 'grep -Ps -- '"'"'(\/var\/run\/utmp|\/var\/log\/wtmp|\/var\/log\/btmp)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-session.rules:-a always,exit -F arch=b64 -S all -F' || { echo step2: missing '/etc/audit/rules.d/50-session.rules:-a always,exit -F arch=b'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'path=/var/run/utmp -F perm=wa -k session' || { echo step2: missing 'path=/var/run/utmp -F perm=wa -k session'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-session.rules:-a always,exit -F arch=b64 -S all -F' || { echo step2: missing '/etc/audit/rules.d/50-session.rules:-a always,exit -F arch=b'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'path=/var/log/wtmp -F perm=wa -k session' || { echo step2: missing 'path=/var/log/wtmp -F perm=wa -k session'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-session.rules:-a always,exit -F arch=b64 -S all -F' || { echo step2: missing '/etc/audit/rules.d/50-session.rules:-a always,exit -F arch=b'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'path=/var/log/btmp -F perm=wa -k session' || { echo step2: missing 'path=/var/log/btmp -F perm=wa -k session'; return 1; }; }; if alt0; then echo compliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Note: • The -w option is deprecated and the rule should be updated in accordance with the Remediation Procedure. • For best performance, the arch field should be supplied in the rule. The individual permissions will cause the selection of specific system calls that use that kind of access. Not supplying the arch will cause the selection of all system calls which will affect performance as all system calls will be evaluated. 1. Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor session initiation information. Example: # printf " -a always,exit -F arch=b64 -S all -F path=/var/run/utmp -F perm=wa -k session -a always,exit -…

Svojstva

Operativni sistemi: sles-16
Oznake: cis-convertedlinux
Referenca: CIS SUSE Linux Enterprise 16 Benchmark v1.0.0 - 6.2.3.20

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target linux --level 2