Detections
Analytics

2.1 Ensure system configuration is documented and verified regularly

Information

Maintain a listing of the system configuration showing assets configured into the system.

All changes to the system configuration should be logged so that the expected configuration is documented. Regular verification of the current configuration makes it possible to identify and correct undocumented system configuration changes.

The syslog facility local1 is chosen as this is also the facility that the Dynamic Resource Manager (DRM) reports to. The command logger simplifies appending command stdout to the syslogd.

Solution

- Below may be considered an example of how to setup a regular (daily) verification of the system configuration. The actual frequency you use might differ. The keyword in the recommendation is: regular.
 - Further, the example also shows two syslog reporting lines: one to a system file, the second to a centralized syslog service.
The second entry is added as a comment because the hostname is likely not correct and/or there is not a centralized syslog server.
 - The syslog facility local1 is used to keep these reports out of the standard syslog facilities. There is not meant to establish a requirement to use facility local1 . An alternate facility can be used as per site policy.

Ensure that the log directory and file exist

# /usr/bin/mkdir -p /var/log/syslog
# /usr/bin/touch /var/log/syslog/inventory.log

If logging for local1.info events is not already configured add this to the syslog configuration:

#!/usr/bin/ksh
/usr/bin/egrep "^local1.info /var/log/syslog/inventory.log" /etc/syslog.conf >/dev/null
if [ $? != 0 ]; then
 print "local1.info /var/log/syslog/inventory.log rotate time 1d files 30 compress" >> /etc/syslog.conf
 refresh -s syslogd || startsrc -s syslogd
fi

Add an entry to the root crontab if it is not already present

#!/usr/bin/ksh
/usr/bin/crontab -l | /usr/bin/egrep "/usr/sbin/lsconf -v" >/dev/null
if [ $? != 0 ]; then
 print "0 0 * * * /usr/sbin/lsconf -v | /usr/bin/logger -p local1.info -t Inventory" >> /var/spool/cron/crontabs/root
 /usr/sbin/lsconf -v | /usr/bin/logger -p local1.info -t Inventory
fi

The scheduling is an example and should be configured according to site policy

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT, PROGRAM MANAGEMENT

References: 800-53|CM-8, 800-53|CM-8(1), 800-53|PM-5, CSCv7|1.4

Plugin: Unix

Control ID: 1fbf429f20b5634457a06181aa9acf3c61d6a345f6a41a3ac5079270c8f469ca