cis-ubuntu1804-v220-5-2-3-7

name	cis-ubuntu1804-v220-5-2-3-7
version	2.2.0
date_published	"2024-01-01T00:00:00.000Z"
category	cis-logging
description	Ensure unsuccessful file access attempts are collected
author	CIS Benchmarks
tags	["cis","ubuntu","linux","ubuntu-18.04","auditing","auditd"]
target	{"platform":"linux","version":"18.04"}
severity_boost	{}

5.2.3.7 Ensure unsuccessful file access attempts are collected

Profile Applicability

• Level 2 - Server
• Level 2 - Workstation

Description

Monitor for unsuccessful attempts to access files. The following parameters are associated with system calls that control files:

• creation - creat
• opening - open, openat
• truncation - truncate, ftruncate

An audit log record will only be written if all of the following criteria is met for the user when trying to access a file:

• a non-privileged user (auid>=UID_MIN)
• is not a Daemon event (auid=4294967295/unset/-1)
• if the system call returned EACCES (permission denied) or EPERM (some other permanent error associated with the specific system call)

Rationale

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Audit

64 Bit systems

On disk configuration

Run the following command to check the on disk rules:

UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "${UID_MIN}" ] && awk "/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \
&&/ -S/ \
&&(/creat/ \
 ||/open/ \
 ||/truncate/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/" /etc/audit/rules.d/*.rules \
|| printf "ERROR: Variable 'UID_MIN' is unset.\n"

Verify the output includes:

-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access

Running configuration

Run the following command to check loaded rules:

UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "" ] && auditctl -l | awk  \
||