| name | cis-ubuntu1804-v220-5-2-3-7 |
| version | 2.2.0 |
| date_published | "2024-01-01T00:00:00.000Z" |
| category | cis-logging |
| description | Ensure unsuccessful file access attempts are collected |
| author | CIS Benchmarks |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","auditing","auditd"] |
| target | {"platform":"linux","version":"18.04"} |
| severity_boost | {} |
5.2.3.7 Ensure unsuccessful file access attempts are collected
Profile Applicability
- Level 2 - Server
- Level 2 - Workstation
Description
Monitor for unsuccessful attempts to access files. The following parameters are associated with system calls that control files:
- creation -
creat
- opening -
open, openat
- truncation -
truncate, ftruncate
An audit log record will only be written if all of the following criteria is met for the user when trying to access a file:
- a non-privileged user (auid>=UID_MIN)
- is not a Daemon event (auid=4294967295/unset/-1)
- if the system call returned EACCES (permission denied) or EPERM (some other permanent error associated with the specific system call)
Rationale
Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.
Audit
64 Bit systems
On disk configuration
Run the following command to check the on disk rules:
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "${UID_MIN}" ] && awk "/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \
&&/ -S/ \
&&(/creat/ \
||/open/ \
||/truncate/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/" /etc/audit/rules.d/*.rules \
|| printf "ERROR: Variable 'UID_MIN' is unset.\n"
Verify the output includes:
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access
Running configuration
Run the following command to check loaded rules:
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "" ] && auditctl -l | awk \
||
