Detections
Analytics
6.2.3.5 Ensure events that modify sethostname and setdomainname are collected
Information
Record changes to network environment files or system calls. The below parameters monitors the following system calls, and write an audit event on system call exit:- sethostname - set the systems host name
- setdomainname - set the systems domain name
Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domain name of a system. The changing of these names could potentially break security parameters that are set based on those names.
Solution
- Add the audit rule(s) for the sethostname and setdomainname system calls. The procedure adds a rule for each audit ABI (b64/b32) the running kernel supports and skips any unsupported ABI or system call, so augenrules --load does not error. Run:#!/usr/bin/env bash
{
for ARCH in b64 b32; do
CALLS=""; for C in sethostname setdomainname; do ausyscall "$ARCH" "$C" >/dev/null 2>&1 && CALLS="${CALLS:+$CALLS,}$C"; done
[ -n "$CALLS" ] && printf '%s\n' "-a always,exit -F arch=$ARCH -S $CALLS -k system-locale"
done >> /etc/audit/rules.d/50-system_locale.rules
}
- Merge and load the rules into active configuration:
# augenrules --load
- Check if reboot is required:
# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi
See Also
Item Details
Audit Name: CIS Rocky Linux 9 v3.0.0 L2 Server
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|5.5
Plugin: Unix
Control ID: 91b0917acc8803439e418d9f70bc76000cc487b79b1f98aa28be4c8ecd716b92