CIS Ubuntu Linux 18.04 LTS Server L2 v2.0.1

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: CIS Ubuntu Linux 18.04 LTS Server L2 v2.0.1

Updated: 5/5/2021

Authority: CIS

Plugin: Unix

Revision: 1.6

Estimated Item Count: 127

Audit Changelog


Revision 1.6 May 5, 2021 Miscellaneous Audit deprecated. Metadata updated.
Revision 1.5 Oct 5, 2020 Functional Update 1.1.1.8 Ensure mounting of FAT filesystems is limited - fstab 1.1.1.8 Ensure mounting of FAT filesystems is limited - lsmod 1.1.1.8 Ensure mounting of FAT filesystems is limited - modprobe 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EACCES (64-bit) 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EPERM (64-bit) 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES (64-bit) 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM (64-bit) 4.1.12 Ensure successful file system mounts are collected - 64-bit 4.1.12 Ensure successful file system mounts are collected - auditctl (64-bit) 4.1.13 Ensure file deletion events by users are collected - 64-bit 4.1.13 Ensure file deletion events by users are collected - auditctl (64-bit) 4.1.16 Ensure kernel module loading and unloading is collected - auditctl init_module/delete_module (64-bit) 4.1.16 Ensure kernel module loading and unloading is collected - init_module/delete_module (64-bit) 4.1.3 Ensure events that modify date and time information are collected - adjtimex (64-bit) 4.1.3 Ensure events that modify date and time information are collected - auditctl adjtimex (64-bit) 4.1.3 Ensure events that modify date and time information are collected - auditctl clock_settime (64-bit) 4.1.3 Ensure events that modify date and time information are collected - clock_settime (64-bit) 4.1.5 Ensure events that modify the system's network environment are collected - auditctl sethostname (64-bit) 4.1.5 Ensure events that modify the system's network environment are collected - sethostname (64-bit) 4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat (64-bit) 4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown (64-bit) 4.1.9 Ensure discretionary access control permission modification events are collected - auditctl xattr (64-bit) 4.1.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat (64-bit) 4.1.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown (64-bit) 4.1.9 Ensure discretionary access control permission modification events are collected - xattr (64-bit) Miscellaneous Platform check updated.
Revision 1.4 Sep 29, 2020 Miscellaneous References updated.
Revision 1.3 Aug 10, 2020 Functional Update 4.1.1.1 Ensure auditd is installed 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EACCES 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EACCES (64-bit) 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EPERM 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EPERM (64-bit) 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM 4.1.12 Ensure successful file system mounts are collected - 32-bit 4.1.12 Ensure successful file system mounts are collected - 64-bit 4.1.13 Ensure file deletion events by users are collected - 32-bit 4.1.13 Ensure file deletion events by users are collected - 64-bit 4.1.14 Ensure changes to system administration scope (sudoers) is collected - sudoers 4.1.14 Ensure changes to system administration scope (sudoers) is collected - sudoers.d 4.1.15 Ensure system administrator actions (sudolog) are collected 4.1.16 Ensure kernel module loading and unloading is collected - init_module/delete_module (64-bit) 4.1.16 Ensure kernel module loading and unloading is collected - init_module/delete_module (32-bit) 4.1.16 Ensure kernel module loading and unloading is collected - insmod 4.1.16 Ensure kernel module loading and unloading is collected - modprobe 4.1.16 Ensure kernel module loading and unloading is collected - rmmod 4.1.3 Ensure events that modify date and time information are collected - /etc/localtime 4.1.3 Ensure events that modify date and time information are collected - adjtimex (32-bit) 4.1.3 Ensure events that modify date and time information are collected - adjtimex (64-bit) 4.1.3 Ensure events that modify date and time information are collected - clock_settime (32-bit) 4.1.3 Ensure events that modify date and time information are collected - clock_settime (64-bit) 4.1.4 Ensure events that modify user/group information are collected - /etc/group 4.1.4 Ensure events that modify user/group information are collected - /etc/gshadow 4.1.4 Ensure events that modify user/group information are collected - /etc/passwd 4.1.4 Ensure events that modify user/group information are collected - /etc/security/opasswd 4.1.4 Ensure events that modify user/group information are collected - /etc/shadow 4.1.5 Ensure events that modify the system's network environment are collected - /etc/hosts 4.1.5 Ensure events that modify the system's network environment are collected - /etc/network 4.1.5 Ensure events that modify the system's network environment are collected - issue 4.1.5 Ensure events that modify the system's network environment are collected - issue.net 4.1.5 Ensure events that modify the system's network environment are collected - sethostname (32-bit) 4.1.5 Ensure events that modify the system's network environment are collected - sethostname (64-bit) 4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor.d/ 4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor/ 4.1.7 Ensure login and logout events are collected - /var/log/faillog 4.1.7 Ensure login and logout events are collected - /var/log/lastlog 4.1.7 Ensure login and logout events are collected - /var/log/tallylog 4.1.8 Ensure session initiation information is collected - btmp 4.1.8 Ensure session initiation information is collected - utmp 4.1.8 Ensure session initiation information is collected - wtmp 4.1.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat 4.1.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat (64-bit) 4.1.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown 4.1.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown (64-bit) 4.1.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr 4.1.9 Ensure discretionary access control permission modification events are collected - xattr (64-bit)
Revision 1.2 Jul 14, 2020 Miscellaneous Metadata updated.
Revision 1.1 Apr 17, 2020 Miscellaneous References updated.