Detections
Analytics

6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tools

Information

Audit tools include the vendor-provided and open-source utilities used to view and manipulate audit records and settings (for example auditctl, auditd, ausearch, aureport, autrace, and augenrules, along with custom queries and report generators). This recommendation uses AIDE (Advanced Intrusion Detection Environment) to protect the integrity of those tools by recording cryptographic hashes and file attributes, so that modification or replacement of a tool can be detected.

Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.

Attackers may replace the audit tools or inject code into the existing tools with the purpose of providing the capability to hide or erase system activity from the audit logs.

Audit tools should be cryptographically signed in order to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files.

Solution

- Run the following command to determine the absolute path to the non-symlinked version on the audit tools:

# readlink -f /sbin

The output will be either /usr/sbin - OR - /sbin . Ensure the correct path is used.

 - Edit /etc/aide.conf and add or update the following selection lines replacing <PATH> with the correct path returned in the command above:

# Audit Tools
<PATH>/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
<PATH>/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
<PATH>/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
<PATH>/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
<PATH>/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
<PATH>/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

Example

# printf '\n%s' "# Audit Tools" "$(readlink -f /sbin/auditctl) p+i+n+u+g+s+b+acl+xattrs+sha512" "$(readlink -f /sbin/auditd) p+i+n+u+g+s+b+acl+xattrs+sha512" "$(readlink -f /sbin/ausearch) p+i+n+u+g+s+b+acl+xattrs+sha512" "$(readlink -f /sbin/aureport) p+i+n+u+g+s+b+acl+xattrs+sha512" "$(readlink -f /sbin/autrace) p+i+n+u+g+s+b+acl+xattrs+sha512" "$(readlink -f /sbin/augenrules) p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide.conf

Note: - IF - /etc/aide.conf includes a @@x_include statement:

Example:

@@x_include /etc/aide.conf.d ^[a-zA-Z0-9_-]+$

 - @@x_include FILE
 - @@x_include DIRECTORY REGEX

 - @x_include is identical to @@include, except that if a config file is executable it is run and the output is used as config.
 - If the executable file exits with status greater than zero or writes to stderr aide stops with an error.
 - For security reasons DIRECTORY and each executable config file must be owned by the current user and must not be group or world-writable.

Impact:

After a legitimate update to an audit tool (for example, a package update), AIDE will report the change until its database is refreshed ( aide --update, or re-initialize the database); refresh the AIDE database after patching so the new binaries are accepted as the baseline.

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-6(9), 800-53|AU-2, 800-53|AU-12, 800-53|SI-7, CSCv7|14.9

Plugin: Unix

Control ID: 629f30a217b7b266ac079b876f9f1fb4d8ee5cb82d92ddf13378360158c8bc1a