Detections
Analytics

RHEL-06-000198 - The audit system must be configured to audit all use of setuid and setgid programs.

Information

Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

At a minimum, the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid / setgid programs, run the following command for each local partition [PART]:

$ sudo find [PART] -xdev -type f -perm /6000 2>/dev/null

Then, for each setuid / setgid program on the system, add a line of the following form to '/etc/audit/audit.rules', where [SETUID_PROG_PATH] is the full path to each setuid / setgid program in the list:

-a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_6_V2R2_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(9), CAT|III, CCI|CCI-002234, Rule-ID|SV-217976r603264_rule, STIG-ID|RHEL-06-000198, STIG-Legacy|SV-50368, STIG-Legacy|V-38567, Vuln-ID|V-217976

Plugin: Unix

Control ID: 48c73718a4fdc00e0c385384b41c5d459b77d08c5e1d2139978f1dc199e9857b