Ensure the running and on disk configuration is the same

低级别 2自动化linux

说明

The Audit system have both on disk and running configuration. It is possible for these configuration settings to differ. Note: Due to the limitations of augenrules and auditctl, it is not absolutely guaranteed that loading the rule sets via augenrules --load will result in all rules being loaded or even that the user will be informed if there was a problem loading the rules.

检查方式

审计方法: Shell 命令

shell

alt0() { command -v augenrules >/dev/null 2>&1 || { echo "step1: augenrules not installed"; return 1; }; o=$(bash -c 'augenrules --check' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/usr/sbin/augenrules: No change' || { echo step1: missing '/usr/sbin/augenrules: No change'; return 1; }; }; if alt0; then echo compliant; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

If the rules are not aligned across all three areas (the *.rules files in /etc/audit/rules.d/, the merged /etc/audit/audit.rules, and the running kernel configuration), run the following command to merge and load all rules: # augenrules --load Check if reboot is required. if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then echo "Reboot required to load rules"; fi

属性

操作系统: rocky-9
标签: cis-convertedlinux
参考: CIS Rocky Linux 9 Benchmark v3.0.0 - 6.2.3.36

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target linux --level 2