Detections
Analytics

6.2.3.9 Ensure events that modify /etc/netplan are collected

Information

Record changes to network environment files or system calls. The files being monitored are:

 - /etc/netplan/ - central location for YAML networking configurations files

Monitoring system events that change network environments, such as tracking changes in the /etc/netplan/ directory ensures swift detection of unauthorized adjustments to network configurations. All audit records should be appropriately tagged for relevance

Solution

Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the system's network environment.

Example:

# printf "
-w /etc/netplan -p wa -k system-locale
" >> /etc/audit/rules.d/50-system_locale.rules

Load audit rules

Merge and load the rules into active configuration:

# augenrules --load

Check if reboot is required.

# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

Note: - IF - The directory /etc/netplan does not exist, this is considered a passing state. Creating a file system rule will result in an error if /etc/netplan does not exist.

See Also

https://workbench.cisecurity.org/benchmarks/26891

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|CM-6, CSCv7|5.5

Plugin: Unix

Control ID: d54bba15a29e64beea161014a5cd94d94b934bd0711a0add2d65d4e19296bf8e