Detections
Analytics

6.2.3.9 Ensure events that modify /etc/NetworkManager directory are collected

Information

Record changes to network environment files or system calls. The files being monitored are:

 - /etc/NetworkManager/ - directory contains configuration files and settings used by the NetworkManager

Monitoring the /etc/NetworkManager/ directory will identify potential unauthorized changes to network configuration files.

Solution

- Add the audit rule(s) that monitor changes to /etc/NetworkManager . The procedure adds each rule only for targets that exist, so augenrules --load does not error. Run:

#!/usr/bin/env bash

{
 [ -d /etc/NetworkManager ] && printf '%s\n' "-a always,exit -S all -F dir=/etc/NetworkManager -F perm=wa -F key=system-locale"
} >> /etc/audit/rules.d/50-system_locale.rules

 - Merge and load the rules into active configuration:

# augenrules --load

 - Check if reboot is required:

# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|5.5

Plugin: Unix

Control ID: fd30e887be6eaccf1950a188eb69d869ba0e53996822102eebbc58b4ba18dedc