cis-ubuntu1604-v200-5-2-3

name	cis-ubuntu1604-v200-5-2-3
description	Ensure sudo log file exists
category	cis-iam
version	2.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-16.04","access-control"]
cis_id	5.2.3
cis_benchmark	CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - 5.2.3

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

sudo can use a custom log file.

Note: visudo edits the sudoers file in a safe fashion, analogous to vipw(8). visudo locks the sudoers file against multiple simultaneous edits, provides basic sanity checks, and checks or parse errors. If the sudoers file is currently being edited you will receive a message to try again later.

Rationale

A sudo log file simplifies auditing of sudo commands.

Impact

None.

Audit Procedure

Command Line

Verify that sudo has a custom log file configured. Run the following command:

grep -Ei '^\s*Defaults\s+logfile=\S+' /etc/sudoers /etc/sudoers.d/*

Expected Result

The output should include a line matching:

Defaults logfile="<PATH TO CUSTOM LOG FILE>"

Example:

Defaults logfile="/var/log/sudo.log"

Remediation

Command Line

Edit the file /etc/sudoers or a file in /etc/sudoers.d/ with visudo -f and add the following line:

Defaults logfile="<PATH TO CUSTOM LOG FILE>"

Example:

Defaults logfile="/var/log/sudo.log"

Default Value

By default, sudo does not have a custom log file configured.

References

None.

CIS Controls

Controls Version	Control
v7	6.3 Enable Detailed Logging

Assessment Status

Automated