Detections
Analytics

6.2.3.8 Ensure events that modify /etc/sysconfig/network and /etc/NetworkManager/system-connections/ are collected

Information

Record changes to network environment files or system calls. The files being monitored are:

 - /etc/sysconfig/network - additional information that is valid to all network interfaces
 - /etc/NetworkManager/system-connections/ - directory containing user-created, persistent network configuration files in a keyfile format.

Monitoring /etc/sysconfig/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records should have a relevant tag associated with them.

Solution

- Add the audit rule(s) that monitor changes to /etc/sysconfig/network and /etc/NetworkManager/system-connections . The procedure adds each rule only for targets that exist, so augenrules --load does not error. Run:

#!/usr/bin/env bash

{
 [ -e /etc/sysconfig/network ] && printf '%s\n' "-a always,exit -S all -F path=/etc/sysconfig/network -F perm=wa -F key=system-locale"
 [ -d /etc/NetworkManager/system-connections ] && printf '%s\n' "-a always,exit -S all -F dir=/etc/NetworkManager/system-connections -F perm=wa -F key=system-locale"
} >> /etc/audit/rules.d/50-system_locale.rules

 - Merge and load the rules into active configuration:

# augenrules --load

 - Check if reboot is required:

# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|5.5

Plugin: Unix

Control ID: 0b4131bda62967ca9d7eaa8fb0be99ecfa19c577368abd2114f5412a8c2f82ab