Ensure the running and on disk configuration is the same

低等級 2自動化linux

說明

The Audit system have both on disk and running configuration. It is possible for these configuration settings to differ. Note: Due to the limitations of augenrules and auditctl, it is not absolutely guaranteed that loading the rule sets via augenrules --load will result in all rules being loaded or even that the user will be informed if there was a problem loading the rules.

檢查方式

稽核方法: Shell 指令

shell

alt0() { command -v augenrules >/dev/null 2>&1 || { echo "step1: augenrules not installed"; return 1; }; o=$(bash -c 'augenrules --check' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/usr/sbin/augenrules: No change' || { echo step1: missing '/usr/sbin/augenrules: No change'; return 1; }; }; if alt0; then echo compliant; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

If the rules are not aligned across all three areas (the *.rules files in /etc/audit/rules.d/, the merged /etc/audit/audit.rules, and the running kernel configuration), run the following command to merge and load all rules: # augenrules --load Check if reboot is required. if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then echo "Reboot required to load rules"; fi

屬性

作業系統: rocky-9
標籤: cis-convertedlinux
參考資料: CIS Rocky Linux 9 Benchmark v3.0.0 - 6.2.3.36

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target linux --level 2