Detections
Analytics

4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Configure grub so that processes that are capable of being audited can be audited even if they start up prior to auditd startup.

Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go undetected.

Note: This recommendation is designed around the grub2 bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.

Solution

Edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX :

GRUB_CMDLINE_LINUX="audit=1"

Run the following script to update the grub2 configuration:

#!/usr/bin/env bash

GFCU()
{
 grubfile=$(find /boot -type f \( -name 'grubenv' -o -name 'grub.conf' -o -name 'grub.cfg' \) -exec grep -Pl '^\h*(kernelopts=|linux|kernel)' {} \;)
 grubdir=$(dirname "$grubfile")
 grub2-mkconfig -o "$grubdir/grub.cfg"
}
GFCU

See Also

https://workbench.cisecurity.org/benchmarks/8415

Item Details

References: CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 5eeb2a55185fa81c03c8f80fdf2289600afb9d6ccc7d8d134f14295475731848