Detections
Analytics

6.2.3.5 Ensure events that modify sethostname and setdomainname are collected

Information

Record changes to network environment files or system calls. The below parameters monitors the following system calls, and write an audit event on system call exit:

 - sethostname - set the systems host name
 - setdomainname - set the systems domain name

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domain name of a system. The changing of these names could potentially break security parameters that are set based on those names.

Solution

- Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the system's network environment.

Example:

# printf "
-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale
" >> /etc/audit/rules.d/50-system_locale.rules

 - Merge and load the rules into active configuration:

# augenrules --load

 - Check if reboot is required:

# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

See Also

https://workbench.cisecurity.org/benchmarks/26891

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|CM-6, CSCv7|5.5

Plugin: Unix

Control ID: d354cafffc4c14b2f4e50b3766ead814122a7c8a59f4bf88c061a1221f82b123