Ensure actions as another user are always logged

DüşükDüzey 2Otomatiklinux

Açıklama

sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

alt0() { o=$(bash -c 'awk '"'"'/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&(/ -C *euid!=uid/||/ -C *uid!=euid/) &&/ -S *execve/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"' /etc/audit/rules.d/*.rules' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S ex'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation' || { echo step1: missing '-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S ex'; return 1; }; o=$(bash -c 'auditctl -l | awk '"'"'/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&(/ -C *euid!=uid/||/ -C *uid!=euid/) &&/ -S *execve/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b64 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing '-a always,exit -F arch=b64 -S execve -C uid!=euid -F auid!=-'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '-a always,exit -F arch=b32 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation' || { echo step2: missing '-a always,exit -F arch=b32 -S execve -C uid!=euid -F auid!=-'; return 1; }; }; if alt0; then echo compliant; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor elevated privileges. Example: # printf " -a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation -a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation " >> /etc/audit/rules.d/50-user_emulation.rules Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Özellikler

İşletim sistemleri: ubuntu-20.04
Etiketler: cis-convertedlinux
Referans: CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 - 6.3.3.2

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target linux --level 2