TMA-SOLARIS-4.4

Enable Auditing of Process and Privilege Events

高级别 1自动化solaris

说明

The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these. Audit: each listed event must carry the cis class in /etc/security/audit_event.

检查方式

审计方法: Shell 命令

shell

[ -r /etc/security/audit_event ] || exit 1; r=compliant; for e in AUE_CHROOT AUE_SETREUID AUE_SETREGID AUE_FCHROOT AUE_PFEXEC AUE_SETUID AUE_NICE AUE_SETGID AUE_PRIOCNTLSYS AUE_SETEGID AUE_SETEUID AUE_SETPPRIV AUE_SETSID AUE_SETPGID; do awk -F: -v e="$e" '$2==e && $4 ~ /(^|,)cis(,|$)/ {f=1} END {exit !f}' /etc/security/audit_event || r="$e not assigned to the cis class"; done; echo "$r"

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

To enforce this setting, run the following commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=":"; OFS=":"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4",cis";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event

属性

操作系统: 任意
标签: solarisaudit
参考: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 4.4 Enable Auditing of Process and Privilege Events

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target solaris