4.1.3.10 Ensure use of privileged commands is collected

Information

Monitor privileged programs (those that have the setuid and/or setgid bit set on execution) to determine if unprivileged users are running these commands.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=<UID_MIN for your system> in the Audit and Remediation procedures.

Reloading the auditd config to set active settings may require a system reboot.

Rationale:

Execution of privileged commands by non-privileged users could be an indication of someone trying to gain unauthorized access to the system.

Solution

To remediate this issue, the system administrator will have to execute a find command to locate all the privileged programs and then add an audit line for each one of them.
The audit parameters associated with this are as follows:

-F path=' $1 ' - will populate each file name found through the find command and processed by awk.

-F perm=x - will write an audit record if the file is executed.

-F audit>=1000 - will write a record if the user executing the command is not a privileged user.

-F auid!= 4294967295 - will ignore Daemon events

All audit records should be tagged with the identifier 'privileged'.
Run the following command replacing with a list of partitions where programs can be executed from on your system:

# find <partition> -xdev ( -perm -4000 -o -perm -2000 ) -type f | awk '{print '-a always,exit -F path=' $1 ' -F perm=x -F auid>=''$(awk '/^s*UID_MIN/{print $2}' /etc/login.defs)'' -F auid!=4294967295 -k privileged' }'

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules and add all resulting lines to the file.
Example:

# find / -xdev ( -perm -4000 -o -perm -2000 ) -type f | awk '{print '-a always,exit -F path=' $1 ' -F perm=x -F auid>=''$(awk '/^s*UID_MIN/{print $2}' /etc/login.defs)'' -F auid!=4294967295 -k privileged' }' >> /etc/audit/rules.d/50-privileged.rules

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: AUDIT AND ACCOUNTABILITY, MAINTENANCE

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-12c., 800-53|MA-4(1)(a), CCI|CCI-000130, CCI|CCI-000135, CCI|CCI-000172, CCI|CCI-002884, CSCv7|6.2, Rule-ID|SV-204548r603261_rule, STIG-ID|RHEL-07-030690

Plugin: Unix

Control ID: 2ba4ba6103515e4e408cda5037867d685ee02d6a30cba0202a7b8748e43f1698