Detections
Analytics

4.2 Enable Auditing of Incoming Network Connections

Information

The Solaris Audit service can be configured to record incoming network connections to any listening service running on the system.

This recommendation will provide an audit trail that contains information related to incoming network connections. While this functionality can be enabled using service-specific mechanisms, using the Solaris Audit service provides a more centralized and complete window into incoming network activity.

Solution

To enforce this setting, run the following commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events:

# cp /etc/security/audit_event /etc/security/audit_event.orig

# awk 'BEGIN{FS=":"; OFS=":"} {if ($2 ~ /AUE_ACCEPT|AUE_CONNECT|AUE_SOCKACCEPT|AUE_SOCKCONNECT|AUE_inetd_connect/) $4=$4",cis";} {print} ' /etc/security/audit_event > /etc/security/audit_event.out

# cp /etc/security/audit_event.out /etc/security/audit_event

See Also

https://workbench.cisecurity.org/benchmarks/4777

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 1e438d1140538e30994ffa18f398e4bc9ca05f840b603bc66fd888c1c74d4dc7