tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add description for 8.1.1.5

This commit is contained in:
samson 2018-11-12 19:39:14 +08:00
parent 8788e7e539
commit 0d0c3b543b
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
docs/harbian_audit_Debian_9_Benchmark_v0.1.mkd
View File

@ -234,6 +234,28 @@ Edit the "/etc/audit/rules.d/audit.rules" file and add the following line:
```
Kernel log monitoring must also be configured to properly alert designated staff. The audit daemon must be restarted for the changes to take effect.
## 8.1.1.5 Ensure set remote_server for audit service (scored)
### Profile Applicability
Level 4
### Description
The operating system must off-load audit records onto a different system or media from the system being audited.
### Rationale
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
### Aduit
Verify the operating system off-loads audit records onto a different system or media from the system being audited. To determine the remote server that the records are being sent to, use the following command:
```
# grep -i remote_server /etc/audisp/audisp-remote.conf
remote_server = 10.0.21.1
```
If a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. If there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.
### Remediation (Need manual fix)
Configure the operating system to off-load audit records onto a different system or media from the system being audited. Set the remote server option in "/etc/audisp/audisp-remote.conf" with the IP address of the log aggregation server.
## 8.1.19 Recored ssh-keysign command usage (scored)
### Profile Applicability