cis-ubuntu2004-v300-6-3-3-5

name	cis-ubuntu2004-v300-6-3-3-5
description	Ensure events that modify the system's network environment are collected
category	cis-logging
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","auditing","auditd"]
cis_id	6.3.3.5
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.3.3.5 Ensure events that modify the system's network environment are collected (Automated)

Profile

• Level 2 - Server
• Level 2 - Workstation

Description

Record changes to network environment files or system calls. The below parameters monitors the following system calls, and write an audit event on system call exit:

• sethostname - set the systems host name
• setdomainname - set the systems domain name

The files being monitored are:

• /etc/issue and /etc/issue.net - messages displayed pre-login
• /etc/hosts - file containing host names and associated IP addresses
• /etc/networks - symbolic names for networks
• /etc/network/ - directory containing network interface scripts and configurations files
• /etc/netplan/ - central location for YAML networking configurations files

Rationale

Monitoring system events that change network environments, such as sethostname and setdomainname, helps identify unauthorized alterations to host and domain names, which could compromise security settings reliant on these names. Changes to /etc/hosts can signal unauthorized attempts to alter machine associations with IP addresses, potentially redirecting users and processes to unintended destinations. Surveillance of /etc/issue and /etc/issue.net is crucial to detect intruders inserting false information to deceive users. Monitoring /etc/network/ reveals modifications to network interfaces or scripts that may jeopardize system availability or security. Additionally, tracking changes in the /etc/netplan/ directory ensures swift detection of unauthorized adjustments to network configurations. All audit records should be appropriately tagged for relevance.

Audit Procedure

Command Line

On disk configuration - Run the following commands to check the on disk rules:

# awk '/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&/ -S/ \
&&(/sethostname/ \
  ||/setdomainname/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules

# awk '/^ *-w/ \
&&(/\/etc\/issue/ \
  ||/\/etc\/issue.net/ \
  ||/\/etc\/hosts/ \
  ||/\/etc\/network \
  ||/\/etc\/netplan) \
&&/ +-p *wa/ \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)