tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-31 01:24:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add description to benchmark doc for 8.1.27

Browse Source
This commit is contained in:
samson 2018-11-25 23:58:01 +08:00
parent 217c3cd020
commit c9099ee2f7
1 changed files with 51 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
docs/harbian_audit_Debian_9_Benchmark_v0.1.mkd
View File

@ -352,7 +352,7 @@ Configure network interfaces to turn off promiscuous mode unless approved by the
#ip link set dev <devicename> multicast off promisc off #ip link set dev <devicename> multicast off promisc off
``` ```
## 8.1.1.4 Set failure mode of audit service (scored) ## 2.1.4 Set failure mode of audit service (scored)
### Profile Applicability ### Profile Applicability
Level 4 Level 4
@ -733,6 +733,7 @@ Verify the operating system generates audit records when successful/unsuccessful
``` ```
If the command does not return any output, this is a finding. If the command does not return any output, this is a finding.
### Remediation
Fixtext: Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "pam_timestamp_check" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": Fixtext: Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "pam_timestamp_check" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules":
``` ```
-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-pam -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-pam
@ -759,6 +760,7 @@ Verify the operating system generates audit records when successful/unsuccessful
``` ```
If the command does not return any output, this is a finding. If the command does not return any output, this is a finding.
### Remediation
Fixtext: Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "pam_tally/pam_tally2" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": Fixtext: Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "pam_tally/pam_tally2" command occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules":
``` ```
-a always,exit -F path=/sbin/pam_tally -F perm=wxa -F auid>=1000 -F auid!=4294967295 -k privileged-pam -a always,exit -F path=/sbin/pam_tally -F perm=wxa -F auid>=1000 -F auid!=4294967295 -k privileged-pam
@ -766,6 +768,54 @@ Fixtext: Configure the operating system to generate audit records when successfu
``` ```
The audit daemon must be restarted for the changes to take effect. The audit daemon must be restarted for the changes to take effect.
## 8.1.27 Record Events That Modify configuration files (scored)
### Profile Applicability
Level 4
### Description
Record events affecting the auditd, grub, fstab, pam, systectl configuration files. th
### Rationale
Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.
### Aduit
Verify the operating system generates audit records that modify configuration. Check the auditing rules in "/etc/audit/audit.rules" with the following command:
```
# grep "config_file_change" /etc/audit/audit.rules
-w /etc/audisp/audisp-remote.conf -p wa -k config_file_change
-w /etc/audit/auditd.conf -p wa -k config_file_change
-w /etc/audit/rules.d/ -p wa -k config_file_change
-w /etc/default/grub -p wa -k config_file_change
-w /etc/fstab -p wa -k config_file_change
-w /etc/hosts.deny -p wa -k config_file_change
-w /etc/login.defs -p wa -k config_file_change
-w /etc/pam.d/ -p wa -k config_file_change
-w /etc/profile -p wa -k config_file_change
-w /etc/profile.d/ -p wa -k config_file_change
-w /etc/security/ -p wa -k config_file_change
-w /etc/sysctl.conf -p wa -k config_file_change
```
If the command does not return any output, this is a finding.
### Remediation
Fixtext: Configure the operating system to generate audit records that modify configuration files. Add or update the following rule in "/etc/audit/rules.d/audit.rules":
```
-w /etc/audisp/audisp-remote.conf -p wa -k config_file_change
-w /etc/audit/auditd.conf -p wa -k config_file_change
-w /etc/audit/rules.d/ -p wa -k config_file_change
-w /etc/default/grub -p wa -k config_file_change
-w /etc/fstab -p wa -k config_file_change
-w /etc/hosts.deny -p wa -k config_file_change
-w /etc/login.defs -p wa -k config_file_change
-w /etc/pam.d/ -p wa -k config_file_change
-w /etc/profile -p wa -k config_file_change
-w /etc/profile.d/ -p wa -k config_file_change
-w /etc/security/ -p wa -k config_file_change
-w /etc/sysctl.conf -p wa -k config_file_change
```
The audit daemon must be restarted for the changes to take effect.
## 8.5 Verifies integrity all packages (scored) ## 8.5 Verifies integrity all packages (scored)
### Profile Applicability ### Profile Applicability