Detections
Analytics

6.2.3.7 Ensure events that modify /etc/hosts and /etc/hostname are collected

Information

Record changes to network environment files or system calls. The files being monitored are:

 - /etc/hosts - file containing host names and associated IP addresses
 - /etc/hostname - file contains the system's host name

The /etc/hosts file is monitored for changes that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines.

Solution

- Add the audit rule(s) that monitor changes to /etc/hosts and /etc/hostname . The procedure adds each rule only for targets that exist, so augenrules --load does not error. Run:

#!/usr/bin/env bash

{
 [ -e /etc/hosts ] && printf '%s\n' "-a always,exit -S all -F path=/etc/hosts -F perm=wa -F key=system-locale"
 [ -e /etc/hostname ] && printf '%s\n' "-a always,exit -S all -F path=/etc/hostname -F perm=wa -F key=system-locale"
} >> /etc/audit/rules.d/50-system_locale.rules

 - Merge and load the rules into active configuration:

# augenrules --load

 - Check if reboot is required:

# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|5.5

Plugin: Unix

Control ID: 75db073f22314344491de6de483f5ddef3d29a95bbdb4f5c5654e315ae87fca0