| name | cis-ubuntu2004-v300-6-3-3-5 |
| description | Ensure events that modify the system's network environment are collected |
| category | cis-logging |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","auditing","auditd"] |
| cis_id | 6.3.3.5 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
6.3.3.5 Ensure events that modify the system's network environment are collected (Automated)
Profile
- Level 2 - Server
- Level 2 - Workstation
Description
Record changes to network environment files or system calls. The below parameters monitors the following system calls, and write an audit event on system call exit:
sethostname - set the systems host namesetdomainname - set the systems domain name
The files being monitored are:
/etc/issue and /etc/issue.net - messages displayed pre-login/etc/hosts - file containing host names and associated IP addresses/etc/networks - symbolic names for networks/etc/network/ - directory containing network interface scripts and configurations files/etc/netplan/ - central location for YAML networking configurations files
Rationale
Monitoring system events that change network environments, such as sethostname and setdomainname, helps identify unauthorized alterations to host and domain names, which could compromise security settings reliant on these names. Changes to /etc/hosts can signal unauthorized attempts to alter machine associations with IP addresses, potentially redirecting users and processes to unintended destinations. Surveillance of /etc/issue and /etc/issue.net is crucial to detect intruders inserting false information to deceive users. Monitoring /etc/network/ reveals modifications to network interfaces or scripts that may jeopardize system availability or security. Additionally, tracking changes in the /etc/netplan/ directory ensures swift detection of unauthorized adjustments to network configurations. All audit records should be appropriately tagged for relevance.
Audit Procedure
Command Line
On disk configuration - Run the following commands to check the on disk rules:
&&/ -F *arch=b(32|64)/ \
&&/ -S/ \
&&(/sethostname/ \
||/setdomainname/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules
# awk '/^ *-w/ \
&&(/\/etc\/issue/ \
||/\/etc\/issue.net/ \
||/\/etc\/hosts/ \
||/\/etc\/network \
||/\/etc\/netplan) \
&&/ +-p *wa/ \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)
