Ensure the running and on disk configuration is the same

DüşükDüzey 2Otomatiklinux

Açıklama

The Audit system have both on disk and running configuration. It is possible for these configuration settings to differ. Note: Due to the limitations of augenrules and auditctl, it is not absolutely guaranteed that loading the rule sets via augenrules --load will result in all rules being loaded or even that the user will be informed if there was a problem loading the rules.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

alt0() { command -v augenrules >/dev/null 2>&1 || { echo "step1: augenrules not installed"; return 1; }; o=$(bash -c 'augenrules --check' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/usr/sbin/augenrules: No change' || { echo step1: missing '/usr/sbin/augenrules: No change'; return 1; }; }; if alt0; then echo compliant; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

If the rules are not aligned across all three areas (the *.rules files in /etc/audit/rules.d/, the merged /etc/audit/audit.rules, and the running kernel configuration), run the following command to merge and load all rules: # augenrules --load Check if reboot is required. if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then echo "Reboot required to load rules"; fi

Özellikler

İşletim sistemleri: rocky-9
Etiketler: cis-convertedlinux
Referans: CIS Rocky Linux 9 Benchmark v3.0.0 - 6.2.3.36

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target linux --level 2