Detections
Analytics

6.2.3.6 Ensure events that modify /etc/issue and /etc/issue.net are collected

Information

Record changes to network environment files or system calls. The files being monitored are:

 - /etc/issue and /etc/issue.net - messages displayed pre-login

Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder.

Solution

- Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the system's network environment.

Example:

# printf "
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
" >> /etc/audit/rules.d/50-etc_issue_system_locale.rules

 - Merge and load the rules into active configuration:

# augenrules --load

 - Check if reboot is required:

# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

See Also

https://workbench.cisecurity.org/benchmarks/26891

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|CM-6, CSCv7|5.5

Plugin: Unix

Control ID: d08050a3315d0c09c805e84f95469c1e6f347be738990965ed70ec37dfb14af0