Ensure actions as another user are always logged

NiskaNivo 2Automatskalinux

Opis

sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user.

Kako se proverava

Metod provere: Komanda ljuske

shell

alt0() { command -v auditctl >/dev/null 2>&1 || { echo "step1: auditctl not installed"; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'auditctl -l | grep execve' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S ex'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S ex'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep -Ps -- '"'"'execve'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F arch=b64 -S' || { echo step2: missing '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F arch=b32 -S' || { echo step2: missing '/etc/audit/rules.d/50-user_emulation.rules:-a always,exit -F'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing 'execve -C uid!=euid -F auid!=-1 -F key=user_emulation'; return 1; }; }; if alt0; then echo compliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

1. Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor elevated privileges. Example: # printf " -a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation -a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation " >> /etc/audit/rules.d/50-user_emulation.rules 2. Merge and load the rules into active configuration: # augenrules --load 3. Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Svojstva

Operativni sistemi: ubuntu-24.04
Oznake: cis-convertedlinux
Referenca: CIS Ubuntu Linux 24.04 LTS Benchmark v2.0.0 - 6.2.3.2

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target linux --level 2