Ensure syslog local logging is configured

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

out=$(grep -Ev "^[[:blank:]]*(#|$)" /etc/syslog.conf 2>/dev/null) || exit 1; r=compliant; printf '%s\n' "$out" | grep -Eq "(^|;)auth\.info[[:blank:]]+/" || r="auth.info not logged locally"; printf '%s\n' "$out" | grep -Eq "^\*\.info[^[:blank:]]*[[:blank:]]+/" || r="*.info not logged locally"; echo "$r"

Đầu ra mong đợi

compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

If not already present, explicitly define a log file for the auth.info output in /etc/syslog.conf: printf "auth.info\t\t/var/log/syslog/auth.log rotate time 1d files 30 compress\n" >> /etc/syslog.conf NOTE: This ensures that remote login, sudo or su attempts are logged separately Create the authlog file and make it readable by root only: # /usr/bin/touch /var/log/syslog/auth.log # /usr/bin/chown root:system /var/log/syslog/auth.log # /usr/bin/chmod u=rw,go= /var/log/syslog/auth.log If not already present, create an entry in /etc/syslog.conf to capture all other output of level info or higher, excluding authentication information, as this is to be captured within /var/log/syslog/info.log: printf "*.info;auth.none\t/var/log/syslog/info.log rotate time 1d files 30 compress\n" >> /etc/syslog.conf Create the syslog file: # /usr/bin/touch /var/log/syslog/info.log # /usr/bin/chown root:system /var/log/syslog/info.log # /usr/bin/chmod u=rw,g=r,o= /var/log/syslog/info.log Refresh syslogd to force the daemon to read the edited /etc/syslog.conf: # refresh -s syslogd

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

tmaegis scan --target aix