Ensure audit log files group owner is configured

ThấpCấp 2Tự độnglinux

Mô tả

Audit log files contain information about the system and system activity.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_output="" l_output2=""
   if [ -e "/etc/audit/auditd.conf" ]; then
      l_audit_log_directory="$(dirname "$(awk -F= '"'"'/^\s*log_file\s*/{print $2}'"'"' /etc/audit/auditd.conf | xargs)")"
      l_audit_log_group="$(awk -F= '"'"'/^\s*log_group\s*/{print $2}'"'"' /etc/audit/auditd.conf | xargs)"
      if grep -Pq -- '"'"'^\h*(root|adm)\h*$'"'"' <<< "$l_audit_log_group"; then
         l_output="$l_output\n  - Log file group correctly set to: \"$l_audit_log_group\" in \"/etc/audit/auditd.conf\""
      else
         l_output2="$l_output2\n  - Log file group is set to: \"$l_audit_log_group\" in \"/etc/audit/auditd.conf\"\n     (should be set to group: \"root or adm\")\n"
      fi
      if [ -d "$l_audit_log_directory" ]; then
         while IFS= read -r -d $'"'"'\0'"'"' l_file; do
            l_output2="$l_output2\n  - File: \"$l_file\" is group owned by group: \"$(stat -Lc '"'"'%G'"'"' "$l_file")\"\n     (should be group owned by group: \"root or adm\")\n"
         done < <(find "$l_audit_log_directory" -maxdepth 1 -type f \( ! - group root -a ! -group adm \) -print0)
      else
         l_output2="$l_output2\n  - Log file directory not set in \"/etc/audit/auditd.conf\" please set log file directory"
      fi
   else
      l_output2="$l_output2\n  - File: \"/etc/audit/auditd.conf\" not found.\n  - ** Verify auditd is installed **"
   fi
   if [ -z "$l_output2" ]; then
      l_output="$l_output\n  - All files in \"$l_audit_log_directory\" are group owned by group: \"root or adm\"\n"
      echo -e "\n- Audit Result:\n  ** PASS **\n - * Correctly configured * :$l_output"
   else
      echo -e "\n- Audit Result:\n  ** FAIL **\n - * Reasons for audit failure * :$l_output2\n"
      [ -n "$l_output" ] && echo -e " - * Correctly configured * :\n$l_output\n"
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Run the following command to configure the audit log files to be owned by adm group: # find $(dirname $(awk -F"=" '/^\s*log_file\s*=\s*/ {print $2}' /etc/audit/auditd.conf | xargs)) -type f $ ! -group adm -a ! -group root $ -exec chgrp adm {} + Run the following command to configure the audit log files to be owned by the adm group: # chgrp adm /var/log/audit/ Run the following command to set the log_group parameter in the audit configuration file to log_group = adm: # sed -ri 's/^\s*#?\s*log_group\s*=\s*\S+(\s*#.*)?.*$/log_group = adm\1/' /etc/audit/auditd.conf Run the following command to restart the audit daemon to reload the configuration file: # systemctl restart auditd

Thuộc tính

Hệ điều hành: rocky-8
Thẻ: cis-convertedlinux
Tham chiếu: CIS Rocky Linux 8 Benchmark v3.0.0 - 6.3.4.4

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target linux --level 2