cis-ubuntu2004-v300-6-3-3-7

name	cis-ubuntu2004-v300-6-3-3-7
description	Ensure unsuccessful file access attempts are collected
category	cis-logging
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","auditing","auditd"]
cis_id	6.3.3.7
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.3.3.7 Ensure unsuccessful file access attempts are collected (Automated)

Profile

• Level 2 - Server
• Level 2 - Workstation

Description

Monitor for unsuccessful attempts to access files. The following parameters are associated with system calls that control files:

• creation - creat
• opening - open, openat
• truncation - truncate, ftruncate

An audit log record will only be written if all of the following criteria is met for the user when trying to access a file:

• a non-privileged user (auid>=UID_MIN)
• is not a Daemon event (auid=4294967295/unset/-1)
• if the system call returned EACCES (permission denied) or EPERM (some other permanent error associated with the specific system call)

Rationale

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Audit Procedure

Command Line

On disk configuration - Run the following command to check the on disk rules:

# {
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
[ -n "${UID_MIN}" ] && awk "/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \
&&/ -F *auid>=${UID_MIN}/ \
&&(/ -F *exit=-EACCES/||/ -F *exit=-EPERM/) \
&&/ -S/ \
&&/creat/ \
&&/open/ \
&&/truncate/ \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" /etc/audit/rules.d/*.rules \
|| printf "ERROR: Variable 'UID_MIN' is unset.\n"
}

Verify the output includes:

-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access

Expected Result

Both on disk and running configuration should show file access attempt audit rules.

Remediation