Detections
Analytics

Revision 1.17

Feb 1, 2024
Functional Update
  • 1.1.1.2 Ensure mounting of squashfs filesystems is disabled
  • 1.1.1.3 Ensure mounting of udf filesystems is disabled
  • 1.1.3.1 Ensure separate partition exists for /var
  • 1.1.4.1 Ensure separate partition exists for /var/tmp
  • 1.1.5.1 Ensure separate partition exists for /var/log
  • 1.1.6.1 Ensure separate partition exists for /var/log/audit
  • 1.1.7.1 Ensure separate partition exists for /home
  • 1.1.9 Disable Automounting
  • 1.6.1.4 Ensure all AppArmor Profiles are enforcing - complain
  • 1.6.1.4 Ensure all AppArmor Profiles are enforcing - loaded
  • 1.6.1.4 Ensure all AppArmor Profiles are enforcing - unconfined
  • 3.1.3 Ensure DCCP is disabled - blacklist
  • 3.1.3 Ensure DCCP is disabled - lsmod
  • 3.1.4 Ensure SCTP is disabled - blacklist
  • 3.1.4 Ensure SCTP is disabled - lsmod
  • 3.1.4 Ensure SCTP is disabled - modprobe
  • 3.1.5 Ensure RDS is disabled - blacklist
  • 3.1.5 Ensure RDS is disabled - lsmod
  • 3.1.5 Ensure RDS is disabled - modprobe
  • 3.1.6 Ensure TIPC is disabled - blacklist
  • 3.1.6 Ensure TIPC is disabled - lsmod
  • 3.1.6 Ensure TIPC is disabled - modprobe
  • 4.1.1.1 Ensure auditd is installed
  • 4.1.1.2 Ensure auditd service is enabled and active - active
  • 4.1.1.2 Ensure auditd service is enabled and active - enabled
  • 4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled
  • 4.1.1.4 Ensure audit_backlog_limit is sufficient
  • 4.1.2.1 Ensure audit log storage size is configured
  • 4.1.2.2 Ensure audit logs are not automatically deleted
  • 4.1.2.3 Ensure system is disabled when audit logs are full - 'action_mail_acct = root'
  • 4.1.2.3 Ensure system is disabled when audit logs are full - 'admin_space_left_action'
  • 4.1.2.3 Ensure system is disabled when audit logs are full - 'space_left_action = email'
  • 4.1.3.20 Ensure the audit configuration is immutable
  • 4.1.3.21 Ensure the running and on disk configuration is the same
  • 4.1.4.1 Ensure audit log files are mode 0640 or less permissive
  • 4.1.4.10 Ensure audit tools belong to group root
  • 4.1.4.2 Ensure only authorized users own audit log files
  • 4.1.4.3 Ensure only authorized groups are assigned ownership of audit log files
  • 4.1.4.3 Ensure only authorized groups are assigned ownership of audit log files - auditd.conf log_group
  • 4.1.4.4 Ensure the audit log directory is 0750 or more restrictive
  • 4.1.4.5 Ensure audit configuration files are 640 or more restrictive
  • 4.1.4.6 Ensure audit configuration files are owned by root
  • 4.1.4.7 Ensure audit configuration files belong to group root
  • 4.1.4.8 Ensure audit tools are 755 or more restrictive
  • 4.1.4.9 Ensure audit tools are owned by root
  • 5.2.16 Ensure SSH AllowTcpForwarding is disabled
  • 5.3.4 Ensure users must provide password for privilege escalation
Miscellaneous
  • Metadata updated.
  • Variables updated.
Added
  • 4.1.3.1 Ensure changes to system administration scope (sudoers) is collected
  • 4.1.3.10 Ensure successful file system mounts are collected
  • 4.1.3.11 Ensure session initiation information is collected
  • 4.1.3.12 Ensure login and logout events are collected
  • 4.1.3.13 Ensure file deletion events by users are collected
  • 4.1.3.14 Ensure events that modify the system's Mandatory Access Controls are collected
  • 4.1.3.15 Ensure successful and unsuccessful attempts to use the chcon command are recorded
  • 4.1.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are recorded
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded
  • 4.1.3.18 Ensure successful and unsuccessful attempts to use the usermod command are recorded
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected
  • 4.1.3.2 Ensure actions as another user are always logged
  • 4.1.3.3 Ensure events that modify the sudo log file are collected
  • 4.1.3.4 Ensure events that modify date and time information are collected
  • 4.1.3.5 Ensure events that modify the system's network environment are collected
  • 4.1.3.6 Ensure use of privileged commands are collected
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected
  • 4.1.3.8 Ensure events that modify user/group information are collected
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected
  • 5.2.12 Ensure SSH X11 forwarding is disabled
Removed
  • 4.1.3.1 Ensure changes to system administration scope (sudoers) is collected - auditctl sudoers
  • 4.1.3.1 Ensure changes to system administration scope (sudoers) is collected - auditctl sudoers.d
  • 4.1.3.1 Ensure changes to system administration scope (sudoers) is collected - sudoers
  • 4.1.3.1 Ensure changes to system administration scope (sudoers) is collected - sudoers.d
  • 4.1.3.10 Ensure successful file system mounts are collected - 32-bit
  • 4.1.3.10 Ensure successful file system mounts are collected - 64-bit
  • 4.1.3.10 Ensure successful file system mounts are collected - auditctl (32-bit)
  • 4.1.3.10 Ensure successful file system mounts are collected - auditctl (64-bit)
  • 4.1.3.11 Ensure session initiation information is collected - auditctl btmp
  • 4.1.3.11 Ensure session initiation information is collected - auditctl utmp
  • 4.1.3.11 Ensure session initiation information is collected - auditctl wtmp
  • 4.1.3.11 Ensure session initiation information is collected - btmp
  • 4.1.3.11 Ensure session initiation information is collected - utmp
  • 4.1.3.11 Ensure session initiation information is collected - wtmp
  • 4.1.3.12 Ensure login and logout events are collected - /var/log/lastlog
  • 4.1.3.12 Ensure login and logout events are collected - /var/run/faillock
  • 4.1.3.12 Ensure login and logout events are collected - auditctl /var/log/lastlog
  • 4.1.3.12 Ensure login and logout events are collected - auditctl /var/run/faillock
  • 4.1.3.13 Ensure file deletion events by users are collected - 32-bit
  • 4.1.3.13 Ensure file deletion events by users are collected - 64-bit
  • 4.1.3.13 Ensure file deletion events by users are collected - auditctl (32-bit)
  • 4.1.3.13 Ensure file deletion events by users are collected - auditctl (64-bit)
  • 4.1.3.14 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor.d/
  • 4.1.3.14 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor/
  • 4.1.3.14 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/apparmor.d/
  • 4.1.3.14 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/apparmor/
  • 4.1.3.15 Ensure successful and unsuccessful attempts to use the chcon command are recorded - /etc/audit/rules.d/*.rules
  • 4.1.3.15 Ensure successful and unsuccessful attempts to use the chcon command are recorded - auditctl
  • 4.1.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are recorded - /etc/audit/rules.d/*.rules
  • 4.1.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are recorded - auditctl
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - /etc/audit/rules.d/*.rules
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - auditctl
  • 4.1.3.18 Ensure successful and unsuccessful attempts to use the usermod command are recorded - /etc/audit/rules.d/*.rules
  • 4.1.3.18 Ensure successful and unsuccessful attempts to use the usermod command are recorded - auditctl
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - /usr/bin/kmod (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl /usr/bin/kmod (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl modules (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - modules (64-bit)
  • 4.1.3.2 Ensure actions as another user are always logged - auditctl b32
  • 4.1.3.2 Ensure actions as another user are always logged - auditctl b64
  • 4.1.3.2 Ensure actions as another user are always logged - rules.d b32
  • 4.1.3.2 Ensure actions as another user are always logged - rules.d b64
  • 4.1.3.3 Ensure events that modify the sudo log file are collected - auditctl sudo log
  • 4.1.3.3 Ensure events that modify the sudo log file are collected - sudo log
  • 4.1.3.4 Ensure events that modify date and time information are collected - (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - /etc/localtime
  • 4.1.3.4 Ensure events that modify date and time information are collected - audiitctl (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl /etc/localtime
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/hosts
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/network/
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/networks
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl /etc/networks
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl hosts
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl issue
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl issue.net
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl network
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl sethostname (32-bit)
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl sethostname (64-bit)
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - issue
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - issue.net
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (32-bit)
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (64-bit)
  • 4.1.3.6 Ensure use of privileged commands are collected - /etc/audit/rules.d
  • 4.1.3.6 Ensure use of privileged commands are collected - auditctl
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b64
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b64
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b64
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b64
  • 4.1.3.8 Ensure events that modify user/group information are collected - /etc/group
  • 4.1.3.8 Ensure events that modify user/group information are collected - /etc/gshadow
  • 4.1.3.8 Ensure events that modify user/group information are collected - /etc/passwd
  • 4.1.3.8 Ensure events that modify user/group information are collected - /etc/security/opasswd
  • 4.1.3.8 Ensure events that modify user/group information are collected - /etc/shadow
  • 4.1.3.8 Ensure events that modify user/group information are collected - auditctl /etc/group
  • 4.1.3.8 Ensure events that modify user/group information are collected - auditctl /etc/gshadow
  • 4.1.3.8 Ensure events that modify user/group information are collected - auditctl /etc/passwd
  • 4.1.3.8 Ensure events that modify user/group information are collected - auditctl /etc/security/opasswd
  • 4.1.3.8 Ensure events that modify user/group information are collected - auditctl /etc/shadow
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr