| name | cis-ubuntu1804-v220-5-2-3-10 |
| version | 2.2.0 |
| date_published | "2024-01-01T00:00:00.000Z" |
| category | cis-logging |
| description | Ensure unsuccessful unauthorized file access attempts are collected |
| author | CIS Benchmarks |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","auditing","auditd"] |
| target | {"platform":"linux","version":"18.04"} |
| severity_boost | {} |
5.2.3.10 Ensure unsuccessful unauthorized file access attempts are collected
Profile Applicability
- Level 2 - Server
- Level 2 - Workstation
Description
Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation (creat), opening (open, openat) and truncation (truncate, ftruncate) of files. An audit log record will only be written for non-privileged users and for a non-Daemon event. All audit records will be tagged with the identifier "access."
Rationale
Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.
Audit
Run the following commands to verify auditd is configured in accordance with site policy. For on disk configuration, the -S options may be on one line or multiple lines. For running configuration, the system calls will be on one line.
On disk configuration
64 Bit systems
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "${UID_MIN}" ] && awk "/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \
&&/ -S/ \
&&(/creat/ \
||/open/ \
||/truncate/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/" /etc/audit/rules.d/*.rules \
|| printf "ERROR: Variable 'UID_MIN' is unset.\n"
Verify output includes:
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access
Running configuration
64 Bit systems
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "${UID_MIN}" ] && auditctl -l | awk "/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \
&&/ -S/ \
&&(/creat/ \
||/open/ \
||/truncate/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/" \
||
