Detections
Analytics

CIS Ubuntu Linux 22.04 LTS Server L2 v.1.0.0

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: CIS Ubuntu Linux 22.04 LTS Server L2 v.1.0.0

Updated: 6/17/2024

Authority: CIS

Plugin: Unix

Revision: 1.19

Estimated Item Count: 135

File Details

Filename: CIS_Ubuntu_22.04_LTS_v1.0.0_Server_L2.audit

Size: 446 kB

MD5: 6b881f0618249d1b73a1d8c846af31a7
SHA256: ad103d6d41cf438a3e991b3ccd05c377f0737e8fe7c28aa17c144f407bf3ea5b

Audit Changelog

 
Revision 1.19

Jun 17, 2024

Miscellaneous
  • Metadata updated.
Revision 1.18

May 15, 2024

Miscellaneous
  • Audit deprecated.
  • Metadata updated.
  • References updated.
Revision 1.17

Mar 18, 2024

Miscellaneous
  • Variables updated.
Added
  • 4.1.3.6 Ensure use of privileged commands are collected
Removed
  • 4.1.3.6 Ensure use of privileged commands are collected - /etc/audit/rules.d
  • 4.1.3.6 Ensure use of privileged commands are collected - auditctl
Revision 1.16

Mar 11, 2024

Miscellaneous
  • Metadata updated.
Revision 1.15

Mar 7, 2024

Miscellaneous
  • Metadata updated.
Added
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded
Removed
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - /etc/audit/rules.d/*.rules
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - auditctl
Revision 1.14

Nov 17, 2023

Functional Update
  • 5.2.12 Ensure SSH X11 forwarding is disabled
  • 5.2.16 Ensure SSH AllowTcpForwarding is disabled
Revision 1.13

Oct 24, 2023

Functional Update
  • 5.2.12 Ensure SSH X11 forwarding is disabled
  • 5.2.16 Ensure SSH AllowTcpForwarding is disabled
Revision 1.12

Sep 19, 2023

Functional Update
  • 4.1.3.10 Ensure successful file system mounts are collected - 32-bit
  • 4.1.3.10 Ensure successful file system mounts are collected - 64-bit
  • 4.1.3.11 Ensure session initiation information is collected - auditctl btmp
  • 4.1.3.11 Ensure session initiation information is collected - auditctl wtmp
  • 4.1.3.11 Ensure session initiation information is collected - btmp
  • 4.1.3.11 Ensure session initiation information is collected - wtmp
  • 4.1.3.13 Ensure file deletion events by users are collected - 32-bit
  • 4.1.3.13 Ensure file deletion events by users are collected - 64-bit
  • 4.1.3.13 Ensure file deletion events by users are collected - auditctl (32-bit)
  • 4.1.3.13 Ensure file deletion events by users are collected - auditctl (64-bit)
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - /etc/audit/rules.d/*.rules
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - auditctl
  • 4.1.3.4 Ensure events that modify date and time information are collected - /etc/localtime
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl /etc/localtime
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl network
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (32-bit)
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr
Informational Update
  • 4.1.3.4 Ensure events that modify date and time information are collected - /etc/localtime
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl /etc/localtime
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr
Miscellaneous
  • Metadata updated.
Added
  • 4.1.3.12 Ensure login and logout events are collected - /var/run/faillock
  • 4.1.3.12 Ensure login and logout events are collected - auditctl /var/run/faillock
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - /usr/bin/kmod (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl /usr/bin/kmod (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl modules (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - modules (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - audiitctl (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl (64-bit)
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/network/
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/networks
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl networks
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b64
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b64
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b64
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b64
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 setxattr/lsetxattr/fsetxattr/removexattr
Removed
  • 4.1.3.12 Ensure login and logout events are collected - /var/log/faillog
  • 4.1.3.12 Ensure login and logout events are collected - /var/log/tallylog
  • 4.1.3.12 Ensure login and logout events are collected - auditctl /var/log/faillog
  • 4.1.3.12 Ensure login and logout events are collected - auditctl /var/log/tallylog
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl init_module/delete_module (32-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl init_module/delete_module (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl insmod
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl modprobe
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl rmmod
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - init_module/delete_module (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - init_module/delete_module (32-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - insmod
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - modprobe
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - rmmod
  • 4.1.3.4 Ensure events that modify date and time information are collected - adjtimex (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - adjtimex (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl adjtimex (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl clock_settime (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl clock_settime (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - clock_settime (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - clock_settime (64-bit)
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/network
  • 4.1.3.6 Ensure use of privileged commands are collected
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES (64-bit)
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM (64-bit)
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES (64-bit)
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl xattr (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - xattr (64-bit)
Revision 1.11

Aug 24, 2023

Added
  • 1.1.1.2 Ensure mounting of squashfs filesystems is disabled
  • 1.1.1.3 Ensure mounting of udf filesystems is disabled
Removed
  • 1.1.1.2 Ensure mounting of squashfs filesystems is disabled - blacklist
  • 1.1.1.2 Ensure mounting of squashfs filesystems is disabled - lsmod
  • 1.1.1.2 Ensure mounting of squashfs filesystems is disabled - modprobe
  • 1.1.1.3 Ensure mounting of udf filesystems is disabled - blacklist
  • 1.1.1.3 Ensure mounting of udf filesystems is disabled - lsmod
  • 1.1.1.3 Ensure mounting of udf filesystems is disabled - modprobe
Revision 1.10

Jul 5, 2023

Functional Update
  • 4.1.2.3 Ensure system is disabled when audit logs are full - 'action_mail_acct = root'
  • 4.1.2.3 Ensure system is disabled when audit logs are full - 'space_left_action = email'