Detections
Analytics

6.2.3.6 Ensure events that modify /etc/issue and /etc/issue.net are collected

Information

Record changes to network environment files or system calls. The files being monitored are:

 - /etc/issue and /etc/issue.net - messages displayed pre-login

Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder.

Solution

- Add the audit rule(s) that monitor changes to /etc/issue and /etc/issue.net . The procedure adds each rule only for targets that exist, so augenrules --load does not error. Run:

#!/usr/bin/env bash

{
 [ -e /etc/issue ] && printf '%s\n' "-a always,exit -S all -F path=/etc/issue -F perm=wa -F key=system-locale"
 [ -e /etc/issue.net ] && printf '%s\n' "-a always,exit -S all -F path=/etc/issue.net -F perm=wa -F key=system-locale"
} >> /etc/audit/rules.d/50-system_locale.rules

 - Merge and load the rules into active configuration:

# augenrules --load

 - Check if reboot is required:

# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|5.5

Plugin: Unix

Control ID: daa3823142dce23001db63cc9405e942775d01ad7331e9fc89d02ac91d8e7160