Ensure audit_backlog_limit is configured

NiskaNivo 2Automatskalinux

Opis

In the kernel-level audit subsystem, a socket buffer queue is used to hold audit events. Whenever a new audit event is received, it is logged and prepared to be added to this queue. The kernel boot parameter audit_backlog_limit=N, with N representing the amount of messages, will ensure that a queue cannot grow beyond a certain size. If an audit event is logged which would grow the queue beyond this limit, then a failure occurs and is handled according to the system configuration

Kako se proverava

Metod provere: Komanda ljuske

shell

alt0() { command -v find >/dev/null 2>&1 || { echo "step1: find not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'find /boot -type f -name '"'"'grub.cfg'"'"' -exec grep -Ph -- '"'"'^\h*linux'"'"' {} + | grep -Pv '"'"'audit_backlog_limit=\d+\b'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Edit /etc/default/grub and add audit_backlog_limit=N to GRUB_CMDLINE_LINUX. The recommended size for N is 8192 or larger. Example: GRUB_CMDLINE_LINUX="audit_backlog_limit=8192" Run the following command to update the grub2 configuration: # update-grub

Svojstva

Operativni sistemi: ubuntu-20.04
Oznake: cis-convertedlinux
Referenca: CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 - 6.3.1.4

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target linux --level 2