Detections
Analytics

6.2.3.8 Ensure events that modify /etc/network and /etc/networks are collected

Information

Record changes to network environment files or system calls. The files being monitored are:

 - /etc/networks - symbolic names for networks
 - /etc/network/ - directory containing network interface scripts and configurations files

Monitoring the systems network environment is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records should have a relevant tag associated with them.

Solution

- Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the system's network environment.

Example:

# printf "
-w /etc/networks -p wa -k system-locale
-w /etc/network -p wa -k system-locale
" >> /etc/audit/rules.d/50-etc_sysconfig_system_locale.rules

 - Merge and load the rules into active configuration:

# augenrules --load

 - Check if reboot is required:

# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi

See Also

https://workbench.cisecurity.org/benchmarks/26891

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|CM-6, CSCv7|5.5

Plugin: Unix

Control ID: ce587f2b5047e8158db6aa8b006b4c5ece2f16e6f3a1fe9feb243bcac606c78e