1.5.5 Ensure kernel.dmesg_restrict is configured

Information

kernel.dmesg_restrict can be used to configure the Linux kernel and prevent unprivileged users access to information from the kernel's log buffer.

More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.

Restricting access to the kernel message buffer limits access to only root. This prevents attackers from gaining additional system information as a non-privileged user.

Solution

- Review all files being used by systemd-sysctl and comment out or remove all kernel.dmesg_restrict lines that are not kernel.dmesg_restrict=1.

Example script:

#!/usr/bin/env bash

{
l_option=\"kernel.dmesg_restrict\" l_value=\"1\"
l_grep=\"${l_option//./(\\.|\\/)}\" a_files=()
l_systemdsysctl=\"$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)\"
l_ufw_file=\"$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"
[ -f \"$(readlink -e \"$l_ufw_file\")\" ] && \
a_files+=(\"$l_ufw_file\"); a_files+=(\"/etc/sysctl.conf\")
while IFS= read -r l_fname; do
l_file=\"$(readlink -e \"${l_fname//# /}\")\"
[ -n \"$l_file\" ] && ! grep -Psiq -- '(^|\h+)'\"$l_file\"'\b' \
<<< \"${a_files[*]}\" && a_files+=(\"$l_file\")
done < <(\"$l_systemdsysctl\" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in \"${a_files[@]}\"; do
grep -Psio -- '\h*'\"$l_grep\"'\h*=\h*\H+\b' \"$l_file\" \
| grep -Psivq -- '^\h*'\"$l_grep\"'\h*=\h*'\"$l_value\"'\b' && \
sed -ri '/^\s*'\"$l_grep\"'\s*=\s*(0|[2-9]|1[0-9]+)/s/^/# /' \"$l_file\"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:

kernel.dmesg_restrict = 1

Example:

# [ ! -d \"/etc/sysctl.d/\" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' \"\" \"kernel.dmesg_restrict = 1\" >> /etc/sysctl.d/60-kernel_sysctl.conf

Note: If the UFW file was the first file listed in the audit, the entry will be commented out as part of the first step, however updating Uncomplicated Firewall (UFW) may update this change. In this case the updated entry will supersede the entry being created as part of this step.

- Run the following command to load all system configuration files:

# sysctl --system

Impact:

Changing dmesg_restrict to one 1, will restrict access to those users that have the CAP_SYSLOG capability.

Item Details

Audit Name: CIS Debian Linux 13 v1.0.0 L1 Server

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Plugin: Unix

Control ID: eab2f407d28ccc308fd2d742c6c071e3b8d7dccf5559fbef589946dbe112545d

Detections

Analytics

1.5.5 Ensure kernel.dmesg_restrict is configured

Information

Solution

See Also

Item Details