gistfile1.txt

<?xml version="1.0"?>
<NessusClientData_v2>
  <Policy>
    <policyName>Policy Compliance Auditing</policyName>
    <policyComments />
    <Preferences>
      <ServerPreferences>
        <preference>
          <name>TARGET</name>
          <value>10.10.23.102,10.10.37.43,10.10.24.231</value>
        </preference>
        <preference>
          <name>plugin_set</name>
          <value>21157;14272;84239;34220;87413;</value>
        </preference>
        <preference>
          <name>time_window_end</name>
          <value>1616663019</value>
        </preference>
        <preference>
          <name>time_window_start</name>
          <value>1616619819</value>
        </preference>
        <preference>
          <name>time_window</name>
          <value>43200</value>
        </preference>
        <preference>
          <name>agent_targets</name>
          <value>[{"name":"staging","id":158025,"uuid":"b3dbc116-2659-451a-9122-c523220386ea"}]</value>
        </preference>
        <preference>
          <name>tenableio.site_id</name>
          <value>us-2a</value>
        </preference>
        <preference>
          <name>tenableio.scan_nonce</name>
          <value>9d3608bf836add559131d7603d827387603cf02654a1f561a3da11a01dedbd8e</value>
        </preference>
        <preference>
          <name>tenableio.scan_uuid</name>
          <value>641a5ef4-ade6-47bc-b0cd-f53c54e1ed5d</value>
        </preference>
        <preference>
          <name>audit_trail</name>
          <value>none</value>
        </preference>
        <preference>
          <name>local_portscan.netstat_ssh</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>local_portscan.netstat_wmi</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>allow_post_scan_editing</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>reverse_lookup</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>visibility</name>
          <value>private</value>
        </preference>
        <preference>
          <name>staggered_start_mins</name>
          <value>0</value>
        </preference>
        <preference>
          <name>wizard_uuid</name>
          <value>523c833f-e434-a05f-5a52-0c0c2c160b7cd9c901634c382c2d</value>
        </preference>
        <preference>
          <name>no_target</name>
          <value>true</value>
        </preference>
        <preference>
          <name>name</name>
          <value>Policy Compliance Auditing</value>
        </preference>
        <preference>
          <name>retry_status_codes</name>
          <value>400, 403, 429, 500, 501, 502, 503, 504</value>
        </preference>
        <preference>
          <name>ssl_cipher_list</name>
          <value>strong</value>
        </preference>
        <preference>
          <name>update_hostname</name>
          <value>no</value>
        </preference>
        <preference>
          <name>report_cleanup_threshold_days</name>
          <value>30</value>
        </preference>
        <preference>
          <name>retry_sleep_milliseconds</name>
          <value>1500</value>
        </preference>
        <preference>
          <name>strict_certificate_validation</name>
          <value>no</value>
        </preference>
        <preference>
          <name>throttle_scan</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>agent_update_channel</name>
          <value>ga</value>
        </preference>
        <preference>
          <name>max_retries</name>
          <value>0</value>
        </preference>
        <preference>
          <name>listen_port</name>
          <value>1241</value>
        </preference>
        <preference>
          <name>process_priority</name>
          <value>normal</value>
        </preference>
        <preference>
          <name>auto_update</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>max_hosts</name>
          <value>100</value>
        </preference>
        <preference>
          <name>max_checks</name>
          <value>5</value>
        </preference>
        <preference>
          <name>log_whole_attack</name>
          <value>no</value>
        </preference>
        <preference>
          <name>cgi_path</name>
          <value>/cgi-bin:/scripts</value>
        </preference>
        <preference>
          <name>port_range</name>
          <value>default</value>
        </preference>
        <preference>
          <name>optimize_test</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>checks_read_timeout</name>
          <value>5</value>
        </preference>
        <preference>
          <name>non_simult_ports</name>
          <value>139, 445, 3389</value>
        </preference>
        <preference>
          <name>plugins_timeout</name>
          <value>320</value>
        </preference>
        <preference>
          <name>safe_checks</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>auto_enable_dependencies</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>silent_dependencies</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>slice_network_addresses</name>
          <value>no</value>
        </preference>
        <preference>
          <name>listen_address</name>
          <value>0.0.0.0</value>
        </preference>
        <preference>
          <name>ssl_mode</name>
          <value>tls_1_2</value>
        </preference>
        <preference>
          <name>reduce_connections_on_congestion</name>
          <value>no</value>
        </preference>
        <preference>
          <name>stop_scan_on_disconnect</name>
          <value>no</value>
        </preference>
        <preference>
          <name>report_crashes</name>
          <value>yes</value>
        </preference>
        <preference>
          <name>engine.max_hosts</name>
          <value>16</value>
        </preference>
        <preference>
          <name>engine.max_checks</name>
          <value>64</value>
        </preference>
        <preference>
          <name>agent_targets</name>
          <value>[{"name":"staging","id":158025,"uuid":"b3dbc116-2659-451a-9122-c523220386ea"}]</value>
        </preference>
      </ServerPreferences>
      <PluginsPreferences>
        <item>
          <pluginName>Unix Compliance Checks</pluginName>
          <pluginId>21157</pluginId>
          <fullName>Unix Compliance Checks[file]:Policy data #1 :</fullName>
          <preferenceName>Policy data #1 :</preferenceName>
          <preferenceType>file</preferenceType>
          <preferenceValues>{"variables":{"MAX_AUDIT_LOG_FILE_SIZE":["32"]}}</preferenceValues>
          <selectedValue>{"variables":{"MAX_AUDIT_LOG_FILE_SIZE":["32"]}}</selectedValue>
        </item>
        <item>
          <pluginName>Unix Compliance Checks</pluginName>
          <pluginId>21157</pluginId>
          <fullName>Unix Compliance Checks[file]:Policy file #1 :</fullName>
          <preferenceName>Policy file #1 :</preferenceName>
          <preferenceType>file</preferenceType>
          <preferenceValues>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</preferenceValues>
          <selectedValue>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</selectedValue>
        </item>
        <item>
          <pluginName>Unix Compliance Checks</pluginName>
          <pluginId>21157</pluginId>
          <fullName>Unix Compliance Checks[file]:Policy file #2 :</fullName>
          <preferenceName>Policy file #2 :</preferenceName>
          <preferenceType>file</preferenceType>
          <preferenceValues />
          <selectedValue />
        </item>
        <item>
          <pluginName>Unix Compliance Checks</pluginName>
          <pluginId>21157</pluginId>
          <fullName>Unix Compliance Checks[file]:Policy file #3 :</fullName>
          <preferenceName>Policy file #3 :</preferenceName>
          <preferenceType>file</preferenceType>
          <preferenceValues />
          <selectedValue />
        </item>
        <item>
          <pluginName>Unix Compliance Checks</pluginName>
          <pluginId>21157</pluginId>
          <fullName>Unix Compliance Checks[file]:Policy file #4 :</fullName>
          <preferenceName>Policy file #4 :</preferenceName>
          <preferenceType>file</preferenceType>
          <preferenceValues />
          <selectedValue />
        </item>
        <item>
          <pluginName>Unix Compliance Checks</pluginName>
          <pluginId>21157</pluginId>
          <fullName>Unix Compliance Checks[file]:Policy file #5 :</fullName>
          <preferenceName>Policy file #5 :</preferenceName>
          <preferenceType>file</preferenceType>
          <preferenceValues />
          <selectedValue />
        </item>
        <item>
          <pluginName>Unix Compliance Checks</pluginName>
          <pluginId>21157</pluginId>
          <fullName>Unix Compliance Checks[radio]:Docker Scan Scope :</fullName>
          <preferenceName>Docker Scan Scope :</preferenceName>
          <preferenceType>radio</preferenceType>
          <preferenceValues>all</preferenceValues>
          <selectedValue>all</selectedValue>
        </item>
      </PluginsPreferences>
    </Preferences>
    <FamilySelection>
      <FamilyItem>
        <FamilyName>Policy Compliance</FamilyName>
        <Status>mixed</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>CISCO</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>CGI abuses : XSS</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Service detection</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Ubuntu Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>HP-UX Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>DNS</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>FTP</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Virtuozzo Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>RPC</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Netware</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>SCADA</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>SMTP problems</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Misc.</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>FreeBSD Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>VMware ESX Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Junos Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Slackware Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Windows : User management</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>AIX Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Firewalls</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Brute force attacks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Windows : Microsoft Bulletins</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Gentoo Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Debian Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Default Unix Accounts</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>SuSE Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>MacOS X Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Mandriva Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>F5 Networks Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Port scanners</FamilyName>
        <Status>mixed</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Peer-To-Peer File Sharing</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>SNMP</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Amazon Linux Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>NewStart CGSL Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Databases</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Denial of Service</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Solaris Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Red Hat Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Backdoors</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Settings</FamilyName>
        <Status>mixed</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Oracle Linux Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>PhotonOS Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>CGI abuses</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Gain a shell remotely</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Huawei Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>General</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Mobile Devices</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Web Servers</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Fedora Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Palo Alto Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Windows</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>Scientific Linux Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>OracleVM Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
      <FamilyItem>
        <FamilyName>CentOS Local Security Checks</FamilyName>
        <Status>disabled</Status>
      </FamilyItem>
    </FamilySelection>
    <IndividualPluginSelection>
      <PluginItem>
        <PluginId>21157</PluginId>
        <PluginName>Unix Compliance Checks</PluginName>
        <Family>Policy Compliance</Family>
        <Status>enabled</Status>
      </PluginItem>
      <PluginItem>
        <PluginId>14272</PluginId>
        <PluginName>Netstat Portscanner (SSH)</PluginName>
        <Family>Port scanners</Family>
        <Status>enabled</Status>
      </PluginItem>
    </IndividualPluginSelection>
  </Policy>
  <Report name="CIS Ubuntu 18.04 L2" xmlns:cm="http://www.nessus.org/cm">
    <ReportHost name="ip-10-10-23-102">
      <HostProperties>
        <tag name="LastAuthenticatedResults">1616621314</tag>
        <tag name="host-fqdn">ip-10-10-23-102</tag>
        <tag name="host-ip">10.10.23.102</tag>
        <tag name="host-uuid">be0aa70f-071e-4e4b-8c58-fb72e8d182be</tag>
        <tag name="local-checks-proto">local</tag>
        <tag name="TAG">77d3dfe254a648b394753b756e6ad55a</tag>
        <tag name="HOST_START">Wed Mar 24 21:03:39 2021</tag>
        <tag name="HOST_END">Wed Mar 24 22:01:47 2021</tag>
        <tag name="os">other</tag>
        <tag name="policy-used">Policy Compliance Auditing</tag>
        <tag name="Credentialed_Scan">true</tag>
        <tag name="hostname">ip-10-10-23-102</tag>
      </HostProperties>
      <ReportItem severity="0" port="6062" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 6062/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="22" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 22/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="5432" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 5432/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="8126" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 8126/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="5000" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 5000/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="5001" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 5001/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="3000" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 3000/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="3001" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 3001/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="4500" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="udp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 4500/udp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="8125" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="udp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 8125/udp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="68" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="udp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 68/udp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="500" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="udp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 500/udp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="0" pluginFamily="Settings" pluginName="Nessus Scan Information" pluginID="19506" protocol="tcp" svc_name="general">
        <plugin_modification_date>2021/01/27</plugin_modification_date>
        <plugin_publication_date>2005/08/26</plugin_publication_date>
        <plugin_type>summary</plugin_type>
        <solution>n/a</solution>
        <description>This plugin displays, for each tested host, information about the
scan itself :

  - The version of the plugin set.
  - The type of scanner (Nessus or Nessus Home).
  - The version of the Nessus Engine.
  - The port scanner(s) used.
  - The port range scanned.
  - The ping round trip time 
  - Whether credentialed or third-party patch management
    checks are possible.
  - Whether the display of superseded patches is enabled
  - The date of the scan.
  - The duration of the scan.
  - The number of hosts scanned in parallel.
  - The number of checks done in parallel.</description>
        <synopsis>This plugin displays information about the Nessus scan.</synopsis>
        <risk_factor>None</risk_factor>
        <script_version>1.99</script_version>
        <plugin_output>Information about this scan : 

Nessus version : 8.2.2
Plugin feed version : 202103241357
Scanner edition used : Nessus
Scan type : Unix Agent
Scan policy used : Policy Compliance Auditing
Scanner IP : 127.0.0.1
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : yes (on the localhost)
Attempt Least Privilege : no
Patch management checks : None
Display superseded patches : yes (supersedence plugin did not launch)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 100
Max checks : 5
Recv timeout : 5
Backports : None
Allow post-scan editing: Yes
Scan Start Date : 2021/3/24 21:28 UTC
Scan duration : 18 sec
</plugin_output>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit from CIS Ubuntu Linux 18.04 LTS Benchmark" : [PASSED]

See Also: https://workbench.cisecurity.org/files/2611

Policy Value:
PASSED</description>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>a4a434a6fac51bca9617d1d9cf7276e2efe5afc1a85b890f908a2326aa53881b</cm:compliance-check-id>
        <cm:compliance-check-name>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit from CIS Ubuntu Linux 18.04 LTS Benchmark</cm:compliance-check-name>
        <cm:compliance-policy-value>PASSED</cm:compliance-policy-value>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.1.8 Ensure mounting of FAT filesystems is limited - fstab" : [PASSED]

The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2NS,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/grep -E -i '^[^#]*svfats' /etc/fstab | /usr/bin/awk '{print} END {if (NR == 0) print "none"}'
expect: ^none$
system: Linux

Actual Value:
The command '/bin/grep -E -i '^[^#]*svfats' /etc/fstab | /usr/bin/awk '{print} END {if (NR == 0) print "none"}'' returned : 

none</description>
        <cm:compliance-actual-value>The command '/bin/grep -E -i '^[^#]*svfats' /etc/fstab | /usr/bin/awk '{print} END {if (NR == 0) print "none"}'' returned : 

none</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1604fba75675449755beb16f0ad68142fd18767aa53eb0b79054310d61403fd7</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.1.8 Ensure mounting of FAT filesystems is limited - fstab</cm:compliance-check-name>
        <cm:compliance-info>The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/grep -E -i '^[^#]*svfats' /etc/fstab | /usr/bin/awk '{print} END {if (NR == 0) print "none"}'
expect: ^none$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2NS, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="2" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.1.8 Ensure mounting of FAT filesystems is limited - modprobe" : [WARNING]

The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2NS,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v vfat
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v vfat' did not return any result</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v vfat' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>50e16f4155fa4945be02a15597a3046282783105815d9a45e62ec6ef7ad5069b</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.1.8 Ensure mounting of FAT filesystems is limited - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v vfat
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2NS, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>WARNING</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.1.8 Ensure mounting of FAT filesystems is limited - lsmod" : [PASSED]

The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2NS,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep vfat | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep vfat | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep vfat | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>76982007b1bb9bdc54d74d16d4cc1f6b819812398524502d589132bc6f0a348d</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.1.8 Ensure mounting of FAT filesystems is limited - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep vfat | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2NS, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.6 Ensure separate partition exists for /var" : [FAILED]

The /var directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world-writable.

Rationale:

Since the /var directory may contain world-writable files and directories, there is a risk of resource exhaustion if it is not bound to a separate partition.

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /var .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2S,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/var[\s]'
expect: on[\s]+/var[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/var[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/var[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5b46df3c9922510e376a57510888eecd49b19836c08b3aea191b7a3bb4fe107f</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.6 Ensure separate partition exists for /var</cm:compliance-check-name>
        <cm:compliance-info>The /var directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world-writable.

Rationale:

Since the /var directory may contain world-writable files and directories, there is a risk of resource exhaustion if it is not bound to a separate partition.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/var[\s]'
expect: on[\s]+/var[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2S, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /var .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.7 Ensure separate partition exists for /var/tmp" : [FAILED]

The /var/tmp directory is a world-writable directory used for temporary storage by all users and some applications.

Rationale:

Since the /var/tmp directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. In addition, making /var/tmp its own file system allows an administrator to set the noexec option on the mount, making /var/tmp useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /var/tmp .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2S,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/tmp[\s]'
expect: on[\s]+/var/tmp[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/var/tmp[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/var/tmp[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>416c014598552acbf45a74134514c13afd27758043e47a98e44eb9d515e652fb</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.7 Ensure separate partition exists for /var/tmp</cm:compliance-check-name>
        <cm:compliance-info>The /var/tmp directory is a world-writable directory used for temporary storage by all users and some applications.

Rationale:

Since the /var/tmp directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. In addition, making /var/tmp its own file system allows an administrator to set the noexec option on the mount, making /var/tmp useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/tmp[\s]'
expect: on[\s]+/var/tmp[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2S, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /var/tmp .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.11 Ensure separate partition exists for /var/log" : [FAILED]

The /var/log directory is used by system services to store log data .

Rationale:

There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data.

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /var/log .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var/log it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CN-L3|7.1.2.3(d),CN-L3|7.1.3.3(f),CSCv6|6.3,CSCv7|6.4,CSF|PR.IP-1,ISO/IEC-27001|A.12.4.2,ITSG-33|CM-6,LEVEL|2S,NESA|M5.2.3,NESA|M5.5.2,NESA|T3.2.1,NESA|T3.6.4,NESA|T8.2.9,NIAv2|SM5,NIAv2|SM6,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/log[\s]'
expect: on[\s]+/var/log[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/var/log[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/var/log[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>f600ba0773d6426c319aa28abaa2f97d703ab08f51407e0a794934c1b8e9d15b</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.11 Ensure separate partition exists for /var/log</cm:compliance-check-name>
        <cm:compliance-info>The /var/log directory is used by system services to store log data .

Rationale:

There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/log[\s]'
expect: on[\s]+/var/log[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CN-L3|7.1.2.3(d), CN-L3|7.1.3.3(f), CSCv6|6.3, CSCv7|6.4, CSF|PR.IP-1, ISO/IEC-27001|A.12.4.2, ITSG-33|CM-6, LEVEL|2S, NESA|M5.2.3, NESA|M5.5.2, NESA|T3.2.1, NESA|T3.6.4, NESA|T8.2.9, NIAv2|SM5, NIAv2|SM6, PCI-DSSv3.1|2.2.4, PCI-DSSv3.2|2.2.4, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /var/log .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var/log it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.12 Ensure separate partition exists for /var/log/audit" : [FAILED]

The auditing daemon, auditd , stores log data in the /var/log/audit directory.

Rationale:

There are two important reasons to ensure that data gathered by auditd is stored on a separate partition: protection against resource exhaustion (since the audit.log file can grow quite large) and protection of audit data. The audit daemon calculates how much free space is left and performs actions based on the results. If other processes (such as syslog ) consume space in the same partition as auditd , it may not perform as desired.

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /var/log/audit .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var/log/audit it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.8,800-171|3.4.2,800-53|AU-9,800-53|CM-6,CN-L3|7.1.2.3(d),CN-L3|7.1.3.3(f),CN-L3|8.1.10.6(d),CN-L3|8.1.3.5(c),CN-L3|8.1.4.3(c),CSCv6|6.3,CSCv7|6.4,CSF|PR.IP-1,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.2,ITSG-33|AU-9,ITSG-33|CM-6,LEVEL|2S,NESA|M5.2.3,NESA|M5.5.2,NESA|T3.2.1,NESA|T3.6.4,NESA|T8.2.9,NIAv2|SM5,NIAv2|SM6,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,QCSC-v1|13.2,QCSC-v1|8.2.1,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/log/audit[\s]'
expect: on[\s]+/var/log/audit[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/var/log/audit[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/var/log/audit[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1084bbdd84e5e61d6aba3f0a96dc841602c2c26378cdbbd2cbe1a93fb0038d8c</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.12 Ensure separate partition exists for /var/log/audit</cm:compliance-check-name>
        <cm:compliance-info>The auditing daemon, auditd , stores log data in the /var/log/audit directory.

Rationale:

There are two important reasons to ensure that data gathered by auditd is stored on a separate partition: protection against resource exhaustion (since the audit.log file can grow quite large) and protection of audit data. The audit daemon calculates how much free space is left and performs actions based on the results. If other processes (such as syslog ) consume space in the same partition as auditd , it may not perform as desired.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/log/audit[\s]'
expect: on[\s]+/var/log/audit[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.8, 800-171|3.4.2, 800-53|AU-9, 800-53|CM-6, CN-L3|7.1.2.3(d), CN-L3|7.1.3.3(f), CN-L3|8.1.10.6(d), CN-L3|8.1.3.5(c), CN-L3|8.1.4.3(c), CSCv6|6.3, CSCv7|6.4, CSF|PR.IP-1, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.2, ITSG-33|AU-9, ITSG-33|CM-6, LEVEL|2S, NESA|M5.2.3, NESA|M5.5.2, NESA|T3.2.1, NESA|T3.6.4, NESA|T8.2.9, NIAv2|SM5, NIAv2|SM6, PCI-DSSv3.1|2.2.4, PCI-DSSv3.2|2.2.4, QCSC-v1|13.2, QCSC-v1|8.2.1, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /var/log/audit .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var/log/audit it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.13 Ensure separate partition exists for /home" : [FAILED]

The /home directory is used to support disk storage needs of local users.

Rationale:

If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under /home .

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /home .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2S,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/home[\s]'
expect: on[\s]+/home[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/home[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/home[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>600dc1ad0b30f4abdd58c26d2277f795add102c69b0837c707632730e6428ec2</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.13 Ensure separate partition exists for /home</cm:compliance-check-name>
        <cm:compliance-info>The /home directory is used to support disk storage needs of local users.

Rationale:

If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under /home .</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/home[\s]'
expect: on[\s]+/home[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2S, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /home .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.7.1.4 Ensure all AppArmor Profiles are enforcing - loaded" : [PASSED]

AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.

Solution:
Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.1.1,800-171|3.1.2,800-53|AC-3(3),CSCv6|14.4,CSCv7|14.6,CSF|PR.AC-4,CSF|PR.PT-3,ITSG-33|AC-3(3),LEVEL|2S,NESA|T5.5.4,NESA|T7.5.3,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|5.2.2

Policy Value:
cmd: /usr/sbin/apparmor_status
expect: ^[\s]*[1-9][0-9]*[\s]+profiles[\s]+are[\s]+loaded
system: Linux

Actual Value:
The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1145) 
   /usr/lib/ipsec/charon (1384) 
   /usr/sbin/clamd (1214) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1178) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1634) 
0 processes are unconfined but have a profile defined.</description>
        <cm:compliance-actual-value>The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1145) 
   /usr/lib/ipsec/charon (1384) 
   /usr/sbin/clamd (1214) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1178) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1634) 
0 processes are unconfined but have a profile defined.</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e0be84d79f9cf6937a0d67800e34390571a554557f5b84668874dabc7e706681</cm:compliance-check-id>
        <cm:compliance-check-name>1.7.1.4 Ensure all AppArmor Profiles are enforcing - loaded</cm:compliance-check-name>
        <cm:compliance-info>AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /usr/sbin/apparmor_status
expect: ^[\s]*[1-9][0-9]*[\s]+profiles[\s]+are[\s]+loaded
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.1.1, 800-171|3.1.2, 800-53|AC-3(3), CSCv6|14.4, CSCv7|14.6, CSF|PR.AC-4, CSF|PR.PT-3, ITSG-33|AC-3(3), LEVEL|2S, NESA|T5.5.4, NESA|T7.5.3, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|5.2.2</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.7.1.4 Ensure all AppArmor Profiles are enforcing - complain" : [FAILED]

AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.

Solution:
Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.1.1,800-171|3.1.2,800-53|AC-3(3),CSCv6|14.4,CSCv7|14.6,CSF|PR.AC-4,CSF|PR.PT-3,ITSG-33|AC-3(3),LEVEL|2S,NESA|T5.5.4,NESA|T7.5.3,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|5.2.2

Policy Value:
cmd: /usr/sbin/apparmor_status
expect: ^[\s]*0[\s]+profiles[\s]+are[\s]+in[\s]+complain[\s]+mode
system: Linux

Actual Value:
The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1145) 
   /usr/lib/ipsec/charon (1384) 
   /usr/sbin/clamd (1214) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1178) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1634) 
0 processes are unconfined but have a profile defined.</description>
        <cm:compliance-actual-value>The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1145) 
   /usr/lib/ipsec/charon (1384) 
   /usr/sbin/clamd (1214) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1178) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1634) 
0 processes are unconfined but have a profile defined.</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1670e10d1b4c61e042ee28544faf2e957074b5c8d24c6a9924d02a52d949650a</cm:compliance-check-id>
        <cm:compliance-check-name>1.7.1.4 Ensure all AppArmor Profiles are enforcing - complain</cm:compliance-check-name>
        <cm:compliance-info>AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /usr/sbin/apparmor_status
expect: ^[\s]*0[\s]+profiles[\s]+are[\s]+in[\s]+complain[\s]+mode
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.1.1, 800-171|3.1.2, 800-53|AC-3(3), CSCv6|14.4, CSCv7|14.6, CSF|PR.AC-4, CSF|PR.PT-3, ITSG-33|AC-3(3), LEVEL|2S, NESA|T5.5.4, NESA|T7.5.3, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|5.2.2</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.7.1.4 Ensure all AppArmor Profiles are enforcing - unconfined" : [PASSED]

AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.

Solution:
Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.1.1,800-171|3.1.2,800-53|AC-3(3),CSCv6|14.4,CSCv7|14.6,CSF|PR.AC-4,CSF|PR.PT-3,ITSG-33|AC-3(3),LEVEL|2S,NESA|T5.5.4,NESA|T7.5.3,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|5.2.2

Policy Value:
cmd: /usr/sbin/apparmor_status
expect: ^[\s]*0[\s]+processes[\s]+are[\s]+unconfined
system: Linux

Actual Value:
The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1145) 
   /usr/lib/ipsec/charon (1384) 
   /usr/sbin/clamd (1214) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1178) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1634) 
0 processes are unconfined but have a profile defined.</description>
        <cm:compliance-actual-value>The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1145) 
   /usr/lib/ipsec/charon (1384) 
   /usr/sbin/clamd (1214) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1178) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1634) 
0 processes are unconfined but have a profile defined.</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5a0a9394aa1194432b4689b2901733d9696fb84053104c512f292930ef53572a</cm:compliance-check-id>
        <cm:compliance-check-name>1.7.1.4 Ensure all AppArmor Profiles are enforcing - unconfined</cm:compliance-check-name>
        <cm:compliance-info>AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /usr/sbin/apparmor_status
expect: ^[\s]*0[\s]+processes[\s]+are[\s]+unconfined
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.1.1, 800-171|3.1.2, 800-53|AC-3(3), CSCv6|14.4, CSCv7|14.6, CSF|PR.AC-4, CSF|PR.PT-3, ITSG-33|AC-3(3), LEVEL|2S, NESA|T5.5.4, NESA|T7.5.3, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|5.2.2</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.1 Ensure DCCP is disabled - modprobe" : [FAILED]

The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

Rationale:

If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/dccp.conf
and add the following line:

install dccp /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CIP|007-6-R1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v dccp
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v dccp' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/dccp/dccp.ko</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v dccp' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/dccp/dccp.ko</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e037d1730fcc5a031e6de6a0d1f75ff49783b2de6cb6018827731a84a9c97ae2</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.1 Ensure DCCP is disabled - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

Rationale:

If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v dccp
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CIP|007-6-R1, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/dccp.conf
and add the following line:

install dccp /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.1 Ensure DCCP is disabled - lsmod" : [PASSED]

The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

Rationale:

If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/dccp.conf
and add the following line:

install dccp /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep dccp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep dccp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep dccp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>38e554ce49d5a8e7cd9c29c4015676f0daaff030139d1d6e278d089e83f14e9c</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.1 Ensure DCCP is disabled - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

Rationale:

If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep dccp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/dccp.conf
and add the following line:

install dccp /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.2 Ensure SCTP is disabled - modprobe" : [FAILED]

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/sctp.conf
and add the following line:

install sctp /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CIP|007-6-R1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v sctp
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v sctp' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/sctp/sctp.ko</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v sctp' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/sctp/sctp.ko</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1d9c2eb6c7f711dc687ab63f8ea9aca6790f56362a092dc77656990bfec0f2a9</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.2 Ensure SCTP is disabled - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v sctp
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CIP|007-6-R1, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/sctp.conf
and add the following line:

install sctp /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.2 Ensure SCTP is disabled - lsmod" : [PASSED]

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/sctp.conf
and add the following line:

install sctp /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep sctp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep sctp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep sctp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>3328ad9e63c7fc3da06905f76d3c33e763e1fe9db4f63c4a09c8096bc0afe7d6</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.2 Ensure SCTP is disabled - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep sctp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/sctp.conf
and add the following line:

install sctp /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.3 Ensure RDS is disabled - modprobe" : [FAILED]

The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/rds.conf
and add the following line:

install rds /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CIP|007-6-R1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v rds
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v rds' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/rds/rds.ko</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v rds' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/rds/rds.ko</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>99fd82e0888527989acb12eff6b6ece5bf7800172acd19f1ef243b0e03cb1f5b</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.3 Ensure RDS is disabled - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v rds
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CIP|007-6-R1, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/rds.conf
and add the following line:

install rds /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.3 Ensure RDS is disabled - lsmod" : [PASSED]

The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/rds.conf
and add the following line:

install rds /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep rds | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep rds | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep rds | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>d1a52cc395c78f5e8d7605583c4ac4d7a8e86607a8bff227041c7af748b55925</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.3 Ensure RDS is disabled - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep rds | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/rds.conf
and add the following line:

install rds /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.4 Ensure TIPC is disabled - modprobe" : [FAILED]

The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/tipc.conf
and add the following line:

install tipc /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CIP|007-6-R1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v tipc
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v tipc' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/ipv4/udp_tunnel.ko 
insmod /lib/modules/4.15.0-1011-fips/kernel/net/ipv6/ip6_udp_tunnel.ko 
insmod /lib/modules/4.15.0-1011-fips/kernel/net/tipc/tipc.ko</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v tipc' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/ipv4/udp_tunnel.ko 
insmod /lib/modules/4.15.0-1011-fips/kernel/net/ipv6/ip6_udp_tunnel.ko 
insmod /lib/modules/4.15.0-1011-fips/kernel/net/tipc/tipc.ko</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>3db2caeceeda7a949bd56503baa0c7fe1febfb52b271a578e55a000b0de87a36</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.4 Ensure TIPC is disabled - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v tipc
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CIP|007-6-R1, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/tipc.conf
and add the following line:

install tipc /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.4 Ensure TIPC is disabled - lsmod" : [PASSED]

The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/tipc.conf
and add the following line:

install tipc /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep tipc | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep tipc | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep tipc | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b91d59e016faf4fa49bebb7013728be99e25efc8b40fed3656522e47b46fca39</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.4 Ensure TIPC is disabled - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep tipc | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/tipc.conf
and add the following line:

install tipc /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.7 Disable IPv6" : [FAILED]

Although IPv6 has many advantages over IPv4, not all organizations have IPv6 or dual stack configurations implemented.

Rationale:

If IPv6 or dual stack is not to be used, it is recommended that IPv6 be disabled to reduce the attack surface of the system.

Solution:
Edit /etc/default/grub and add ipv6.disable=1 to the GRUB_CMDLINE_LINUX parameters:

GRUB_CMDLINE_LINUX='ipv6.disable=1'

Run the following command to update the grub2 configuration:

# update-grub

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|SI-7(9),CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv6|11,CSCv6|3,CSCv6|9.1,CSCv7|9.4,CSF|PR.DS-6,LEVEL|2NS,QCSC-v1|3.2

Policy Value:
expect: ipv6\.disable[\s]*=[\s]*1
file: /etc/default/grub
regex: ^[\s]*GRUB_CMDLINE_LINUX[\s]*=[\s]*
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/default/grub - regex '^[\s]*GRUB_CMDLINE_LINUX[\s]*=[\s]*' found - expect 'ipv6\.disable[\s]*=[\s]*1' not found in the following lines:
          11: GRUB_CMDLINE_LINUX="audit=1"</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/default/grub - regex '^[\s]*GRUB_CMDLINE_LINUX[\s]*=[\s]*' found - expect 'ipv6\.disable[\s]*=[\s]*1' not found in the following lines:
          11: GRUB_CMDLINE_LINUX="audit=1"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>dcc9e323d3118c8552c80fa72b9ec93ea2902b582d9f906453a093d36b90f2e4</cm:compliance-check-id>
        <cm:compliance-check-name>3.7 Disable IPv6</cm:compliance-check-name>
        <cm:compliance-info>Although IPv6 has many advantages over IPv4, not all organizations have IPv6 or dual stack configurations implemented.

Rationale:

If IPv6 or dual stack is not to be used, it is recommended that IPv6 be disabled to reduce the attack surface of the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ipv6\.disable[\s]*=[\s]*1
file: /etc/default/grub
regex: ^[\s]*GRUB_CMDLINE_LINUX[\s]*=[\s]*
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|SI-7(9), CN-L3|8.1.2.3, CN-L3|8.1.4.6, CSCv6|11, CSCv6|3, CSCv6|9.1, CSCv7|9.4, CSF|PR.DS-6, LEVEL|2NS, QCSC-v1|3.2</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit /etc/default/grub and add ipv6.disable=1 to the GRUB_CMDLINE_LINUX parameters:

GRUB_CMDLINE_LINUX='ipv6.disable=1'

Run the following command to update the grub2 configuration:

# update-grub</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.1.1 Ensure auditd is installed" : [FAILED]

auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution:
Run the following command to Install auditd

# apt install auditd audispd-plugins

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.8,800-53|CM-7(5),CSCv7|6.2,CSCv7|6.3,CSF|PR.IP-1,CSF|PR.PT-3,ISO/IEC-27001|A.12.5.1,ISO/IEC-27001|A.12.6.2,LEVEL|2S,PCI-DSSv3.1|12.3.7,PCI-DSSv3.2|12.3.7,SWIFT-CSCv1|2.3,TBA-FIISB|44.2.2,TBA-FIISB|49.2.3

Policy Value:
cmd: /usr/bin/dpkg -s audispd-plugins 2>&amp;1
expect: install[\s]+ok[\s]+installed
system: Linux

Actual Value:
The command '/usr/bin/dpkg -s audispd-plugins 2>&amp;1' returned : 

dpkg-query: package 'audispd-plugins' is not installed and no information is available
Use dpkg --info (= dpkg-deb --info) to examine archive files,
and dpkg --contents (= dpkg-deb --contents) to list their contents.</description>
        <cm:compliance-actual-value>The command '/usr/bin/dpkg -s audispd-plugins 2>&amp;1' returned : 

dpkg-query: package 'audispd-plugins' is not installed and no information is available
Use dpkg --info (= dpkg-deb --info) to examine archive files,
and dpkg --contents (= dpkg-deb --contents) to list their contents.</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>a3b73e25f8f83243c98dec8a14f08e61e6cde434944acc7df9334c5c10557b7e</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.1.1 Ensure auditd is installed</cm:compliance-check-name>
        <cm:compliance-info>auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /usr/bin/dpkg -s audispd-plugins 2>&amp;1
expect: install[\s]+ok[\s]+installed
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.8, 800-53|CM-7(5), CSCv7|6.2, CSCv7|6.3, CSF|PR.IP-1, CSF|PR.PT-3, ISO/IEC-27001|A.12.5.1, ISO/IEC-27001|A.12.6.2, LEVEL|2S, PCI-DSSv3.1|12.3.7, PCI-DSSv3.2|12.3.7, SWIFT-CSCv1|2.3, TBA-FIISB|44.2.2, TBA-FIISB|49.2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to Install auditd

# apt install auditd audispd-plugins</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.1.2 Ensure auditd service is enabled" : [PASSED]

Enable and start the auditd daemon to record system events.

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution:
Run the following command to enable auditd :

# systemctl --now enable auditd

Notes:

Additional methods of enabling a service exist. Consult your distribution documentation for appropriate methods.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CIP|007-6-R1,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|6.2,CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /bin/systemctl is-enabled auditd | /usr/bin/awk '{print} END {if(NR==0) print "disabled" }'
dont_echo_cmd: YES
expect: enabled
system: Linux

Actual Value:
The command returned : 

enabled</description>
        <cm:compliance-actual-value>The command returned : 

enabled</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>ab5082f2a6664c330fafb8ccb5a6e113b3acedf28af7be360007128a4e2ee43c</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.1.2 Ensure auditd service is enabled</cm:compliance-check-name>
        <cm:compliance-info>Enable and start the auditd daemon to record system events.

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/systemctl is-enabled auditd | /usr/bin/awk '{print} END {if(NR==0) print "disabled" }'
dont_echo_cmd: YES
expect: enabled
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CIP|007-6-R1, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|6.2, CSCv7|6.2, CSCv7|6.3, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to enable auditd :

# systemctl --now enable auditd

Notes:

Additional methods of enabling a service exist. Consult your distribution documentation for appropriate methods.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled" : [PASSED]

Configure grub so that processes that are capable of being audited can be audited even if they start up prior to auditd startup.

Rationale:

Audit events need to be captured on processes that start up prior to auditd , so that potential malicious activity cannot go undetected.

Solution:
Edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX:

GRUB_CMDLINE_LINUX='audit=1'

Run the following command to update the grub2 configuration:

# update-grub

Notes:

This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.

Replace /boot/grub/grub.cfg with the appropriate grub configuration file for your environment.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-14(1),800-53|SI-7(9),CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv6|6.2,CSCv7|6.2,CSCv7|6.3,CSF|PR.DS-6,CSF|PR.PT-1,LEVEL|2S,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4

Policy Value:
expect: ^[\s]*linux[\s]+.*audit=1.*[\s]*$
file: /boot/grub/grub.cfg
regex: ^[\s]*linux[\s]+
system: Linux

Actual Value:
Compliant file(s):
      /boot/grub/grub.cfg - regex '^[\s]*linux[\s]+' found - expect '^[\s]*linux[\s]+.*audit=1.*[\s]*$' found in the following lines:
          123:         linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          141: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          158: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1
          176: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          193: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1</description>
        <cm:compliance-actual-value>Compliant file(s):
      /boot/grub/grub.cfg - regex '^[\s]*linux[\s]+' found - expect '^[\s]*linux[\s]+.*audit=1.*[\s]*$' found in the following lines:
          123:         linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          141: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          158: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1
          176: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          193: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>beb3e9a25319309353b7d2126839697cb26ef1a207d7b42173b5a7d4768146d7</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled</cm:compliance-check-name>
        <cm:compliance-info>Configure grub so that processes that are capable of being audited can be audited even if they start up prior to auditd startup.

Rationale:

Audit events need to be captured on processes that start up prior to auditd , so that potential malicious activity cannot go undetected.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*linux[\s]+.*audit=1.*[\s]*$
file: /boot/grub/grub.cfg
regex: ^[\s]*linux[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-14(1), 800-53|SI-7(9), CN-L3|8.1.2.3, CN-L3|8.1.4.6, CSCv6|6.2, CSCv7|6.2, CSCv7|6.3, CSF|PR.DS-6, CSF|PR.PT-1, LEVEL|2S, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX:

GRUB_CMDLINE_LINUX='audit=1'

Run the following command to update the grub2 configuration:

# update-grub

Notes:

This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.

Replace /boot/grub/grub.cfg with the appropriate grub configuration file for your environment.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.1.4 Ensure audit_backlog_limit is sufficient" : [FAILED]

The backlog limit has a default setting of 64

Rationale:

during boot if audit=1, then the backlog will hold 64 records. If more that 64 records are created during boot, auditd records will be lost and potential malicious activity could go undetected.

Solution:
Edit /etc/default/grub and add audit_backlog_limit=&lt;BACKLOG SIZE> to GRUB_CMDLINE_LINUX:
Example:

GRUB_CMDLINE_LINUX='audit_backlog_limit=8192'

Run the following command to update the grub2 configuration:

# update-grub

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-14(1),800-53|SI-7(9),CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv7|6.2,CSCv7|6.3,CSF|PR.DS-6,CSF|PR.PT-1,LEVEL|2S,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4

Policy Value:
expect: ^[\s]*linux[\s]+.*audit_backlog_limit=(819[2-9]|8[2-9][0-9]{2}|9[0-9]{3}|[1-9][0-9]{4,}).*[\s]*$
file: /boot/grub/grub.cfg
regex: ^[\s]*linux[\s]+
system: Linux

Actual Value:
Non-compliant file(s):
      /boot/grub/grub.cfg - regex '^[\s]*linux[\s]+' found - expect '^[\s]*linux[\s]+.*audit_backlog_limit=(819[2-9]|8[2-9][0-9]{2}|9[0-9]{3}|[1-9][0-9]{4,}).*[\s]*$' not found in the following lines:
          123:         linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          141: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          158: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1
          176: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          193: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /boot/grub/grub.cfg - regex '^[\s]*linux[\s]+' found - expect '^[\s]*linux[\s]+.*audit_backlog_limit=(819[2-9]|8[2-9][0-9]{2}|9[0-9]{3}|[1-9][0-9]{4,}).*[\s]*$' not found in the following lines:
          123:         linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          141: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          158: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1
          176: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          193: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>0d5a1c8227f347c747dd36d194b25c1c2189dfffc21c8c9bd70fe6233ae8a37b</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.1.4 Ensure audit_backlog_limit is sufficient</cm:compliance-check-name>
        <cm:compliance-info>The backlog limit has a default setting of 64

Rationale:

during boot if audit=1, then the backlog will hold 64 records. If more that 64 records are created during boot, auditd records will be lost and potential malicious activity could go undetected.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*linux[\s]+.*audit_backlog_limit=(819[2-9]|8[2-9][0-9]{2}|9[0-9]{3}|[1-9][0-9]{4,}).*[\s]*$
file: /boot/grub/grub.cfg
regex: ^[\s]*linux[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-14(1), 800-53|SI-7(9), CN-L3|8.1.2.3, CN-L3|8.1.4.6, CSCv7|6.2, CSCv7|6.3, CSF|PR.DS-6, CSF|PR.PT-1, LEVEL|2S, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit /etc/default/grub and add audit_backlog_limit=&lt;BACKLOG SIZE> to GRUB_CMDLINE_LINUX:
Example:

GRUB_CMDLINE_LINUX='audit_backlog_limit=8192'

Run the following command to update the grub2 configuration:

# update-grub</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.1 Ensure audit log storage size is configured" : [FAILED]

Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started.

Rationale:

It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost.

Solution:
Set the following parameter in /etc/audit/auditd.conf in accordance with site policy:

max_log_file = &lt;MB>

Notes:

The max_log_file parameter is measured in megabytes.

Other methods of log rotation may be appropriate based on site policy. One example is time-based rotation strategies which don't have native support in auditd configurations. Manual audit of custom configurations should be evaluated for effectiveness and completeness.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-4,CSCv6|6.3,CSCv7|6.4,CSF|PR.DS-4,CSF|PR.PT-1,ITSG-33|AU-4,LEVEL|2S,NESA|T3.3.1,NESA|T3.6.2

Policy Value:
expect: ^[\s]*max_log_file[\s]*=[\s]*32[\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*max_log_file[\s]*=
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*max_log_file[\s]*=' found - expect '^[\s]*max_log_file[\s]*=[\s]*32[\s]*$' not found in the following lines:
          12: max_log_file = 8</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*max_log_file[\s]*=' found - expect '^[\s]*max_log_file[\s]*=[\s]*32[\s]*$' not found in the following lines:
          12: max_log_file = 8</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e500cc8a802bc7694994e6db78f18b034e1d28782eb4a6912325b339240c22ed</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.1 Ensure audit log storage size is configured</cm:compliance-check-name>
        <cm:compliance-info>Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started.

Rationale:

It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*max_log_file[\s]*=[\s]*32[\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*max_log_file[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-4, CSCv6|6.3, CSCv7|6.4, CSF|PR.DS-4, CSF|PR.PT-1, ITSG-33|AU-4, LEVEL|2S, NESA|T3.3.1, NESA|T3.6.2</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameter in /etc/audit/auditd.conf in accordance with site policy:

max_log_file = &lt;MB>

Notes:

The max_log_file parameter is measured in megabytes.

Other methods of log rotation may be appropriate based on site policy. One example is time-based rotation strategies which don't have native support in auditd configurations. Manual audit of custom configurations should be evaluated for effectiveness and completeness.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.2 Ensure audit logs are not automatically deleted" : [FAILED]

The max_log_file_action setting determines how to handle the audit log file reaching the max file size. A value of keep_logs will rotate the logs but never delete old logs.

Rationale:

In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history.

Solution:
Set the following parameter in /etc/audit/auditd.conf:

max_log_file_action = keep_logs

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.4,800-53|AU-5,CN-L3|7.1.3.3(e),CSCv6|6.3,CSCv7|6.4,CSF|PR.PT-1,ITSG-33|AU-5,LEVEL|2S,NESA|T3.6.2,QCSC-v1|13.2,QCSC-v1|8.2.1

Policy Value:
expect: ^[\s]*max_log_file_action[\s]*=[\s]*[Kk][Ee][Ee][Pp]_[Ll][Oo][Gg][Ss][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*max_log_file_action[\s]*=
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*max_log_file_action[\s]*=' found - expect '^[\s]*max_log_file_action[\s]*=[\s]*[Kk][Ee][Ee][Pp]_[Ll][Oo][Gg][Ss][\s]*$' not found in the following lines:
          19: max_log_file_action = ROTATE</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*max_log_file_action[\s]*=' found - expect '^[\s]*max_log_file_action[\s]*=[\s]*[Kk][Ee][Ee][Pp]_[Ll][Oo][Gg][Ss][\s]*$' not found in the following lines:
          19: max_log_file_action = ROTATE</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>6e13000c5b809d2c8fc00608ff7cd19e333e485822287be53c2e4f2c542242dd</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.2 Ensure audit logs are not automatically deleted</cm:compliance-check-name>
        <cm:compliance-info>The max_log_file_action setting determines how to handle the audit log file reaching the max file size. A value of keep_logs will rotate the logs but never delete old logs.

Rationale:

In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*max_log_file_action[\s]*=[\s]*[Kk][Ee][Ee][Pp]_[Ll][Oo][Gg][Ss][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*max_log_file_action[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.4, 800-53|AU-5, CN-L3|7.1.3.3(e), CSCv6|6.3, CSCv7|6.4, CSF|PR.PT-1, ITSG-33|AU-5, LEVEL|2S, NESA|T3.6.2, QCSC-v1|13.2, QCSC-v1|8.2.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameter in /etc/audit/auditd.conf:

max_log_file_action = keep_logs</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.3 Ensure system is disabled when audit logs are full - 'space_left_action = email'" : [FAILED]

The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution:
Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-5,CSCv6|6.3,CSCv7|6.4,CSF|PR.PT-1,ITSG-33|AU-5,LEVEL|2S,NIAv2|GS7f

Policy Value:
expect: ^[\s]*space_left_action[\s]*=[\s]*[Ee][Mm][Aa][Ii][Ll][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*space_left_action[\s]*=
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*space_left_action[\s]*=' found - expect '^[\s]*space_left_action[\s]*=[\s]*[Ee][Mm][Aa][Ii][Ll][\s]*$' not found in the following lines:
          21: space_left_action = SYSLOG</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*space_left_action[\s]*=' found - expect '^[\s]*space_left_action[\s]*=[\s]*[Ee][Mm][Aa][Ii][Ll][\s]*$' not found in the following lines:
          21: space_left_action = SYSLOG</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>851345a359be44bc57399f60628166b6e59dfdc9952d2be7edc6f30baf14f745</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.3 Ensure system is disabled when audit logs are full - 'space_left_action = email'</cm:compliance-check-name>
        <cm:compliance-info>The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*space_left_action[\s]*=[\s]*[Ee][Mm][Aa][Ii][Ll][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*space_left_action[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-5, CSCv6|6.3, CSCv7|6.4, CSF|PR.PT-1, ITSG-33|AU-5, LEVEL|2S, NIAv2|GS7f</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.3 Ensure system is disabled when audit logs are full - 'action_mail_acct = root'" : [PASSED]

The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution:
Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.4,800-53|AU-5,CN-L3|7.1.3.3(e),CSCv6|6.3,CSCv7|6.4,CSF|PR.PT-1,ITSG-33|AU-5,LEVEL|2S,NESA|T3.6.2,QCSC-v1|13.2,QCSC-v1|8.2.1

Policy Value:
expect: ^[\s]*action_mail_acct[\s]*=[\s]*root[\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*action_mail_acct[\s]*=
system: Linux

Actual Value:
Compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*action_mail_acct[\s]*=' found - expect '^[\s]*action_mail_acct[\s]*=[\s]*root[\s]*$' found in the following lines:
          23: action_mail_acct = root</description>
        <cm:compliance-actual-value>Compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*action_mail_acct[\s]*=' found - expect '^[\s]*action_mail_acct[\s]*=[\s]*root[\s]*$' found in the following lines:
          23: action_mail_acct = root</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>87a5019362188f880b12b0db9f7a6722c0d770cc81e56dc2ad0431e391a8028a</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.3 Ensure system is disabled when audit logs are full - 'action_mail_acct = root'</cm:compliance-check-name>
        <cm:compliance-info>The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*action_mail_acct[\s]*=[\s]*root[\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*action_mail_acct[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.4, 800-53|AU-5, CN-L3|7.1.3.3(e), CSCv6|6.3, CSCv7|6.4, CSF|PR.PT-1, ITSG-33|AU-5, LEVEL|2S, NESA|T3.6.2, QCSC-v1|13.2, QCSC-v1|8.2.1</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.3 Ensure system is disabled when audit logs are full - 'admin_space_left_action = halt'" : [FAILED]

The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution:
Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-5,CSCv6|6.3,CSCv7|6.4,CSF|PR.PT-1,ITSG-33|AU-5,LEVEL|2S

Policy Value:
expect: ^[\s]*admin_space_left_action[\s]*=[\s]*[Hh][Aa][Ll][Tt][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*admin_space_left_action[\s]*=
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*admin_space_left_action[\s]*=' found - expect '^[\s]*admin_space_left_action[\s]*=[\s]*[Hh][Aa][Ll][Tt][\s]*$' not found in the following lines:
          25: admin_space_left_action = SUSPEND</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*admin_space_left_action[\s]*=' found - expect '^[\s]*admin_space_left_action[\s]*=[\s]*[Hh][Aa][Ll][Tt][\s]*$' not found in the following lines:
          25: admin_space_left_action = SUSPEND</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>2d0bf429882a38e136552f24adebfb06fbd0317cc794eed6270bd199397c7ad6</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.3 Ensure system is disabled when audit logs are full - 'admin_space_left_action = halt'</cm:compliance-check-name>
        <cm:compliance-info>The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*admin_space_left_action[\s]*=[\s]*[Hh][Aa][Ll][Tt][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*admin_space_left_action[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-5, CSCv6|6.3, CSCv7|6.4, CSF|PR.PT-1, ITSG-33|AU-5, LEVEL|2S</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>a8b2f2261eb3b7b4d80071498b7d58f37db532a39c36d5524012ce0d209aacb7</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - adjtimex (32-bit)" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: -a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*adjtimex
file: /etc/audit/audit.rules
regex: -a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*adjtimex
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*adjtimex"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*adjtimex"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>7c6ebd0e63d5d58bc54bd5116879744822fde8c539fd3639d932c3d905883797</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - adjtimex (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: -a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*adjtimex
file: /etc/audit/audit.rules
regex: -a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*adjtimex
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - auditctl clock_settime (32-bit)" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+clock_settime[\s]+-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+clock_settime[\s]+-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+clock_settime[\s]+-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e853acce9dc707d6b8eea4d76b70a4167adaa35cca3c51b8910ab1b72d0c0a6e</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - auditctl clock_settime (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+clock_settime[\s]+-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - clock_settime (32-bit)" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: -a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*clock_settime
file: /etc/audit/audit.rules
regex: -a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*clock_settime
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*clock_settime"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*clock_settime"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>8f7bd6440f3595de3ce5858b86e3cba3b1c2c64d04a300eec8ddd29b2054a2ab</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - clock_settime (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: -a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*clock_settime
file: /etc/audit/audit.rules
regex: -a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+.*clock_settime
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - auditctl /etc/localtime" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+time-change$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+time-change$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+time-change$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>d28681e1b34f220361864e365f3e5749befdf339d6d105df25099f689871bf09</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - auditctl /etc/localtime</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+time-change$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - /etc/localtime" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: -w[\s]+/etc/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+.*time-change
file: /etc/audit/audit.rules
regex: -w[\s]+/etc/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+.*time-change
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "-w[\s]+/etc/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+.*time-change"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "-w[\s]+/etc/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+.*time-change"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1ad48da139aca36a97542dff2fca8abec77e14832952157e5672774aeb7c835a</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - /etc/localtime</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: -w[\s]+/etc/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+.*time-change
file: /etc/audit/audit.rules
regex: -w[\s]+/etc/localtime[\s]+-p[\s]+wa[\s]+-k[\s]+.*time-change
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - auditctl adjtimex (64-bit)" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>4498a5dbbb2f0d9cbbfe6506b64302bb0cb1fe2e04385a5472cba0f36dcbb82e</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - auditctl adjtimex (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - auditctl clock_settime (64-bit)" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+clock_settime[\s]+-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+clock_settime[\s]+-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+clock_settime[\s]+-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>4de4992a4a1671fff353d799fcde2677e169b780f53a041d5e6ca0be505c3ce3</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - auditctl clock_settime (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+clock_settime[\s]+-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - adjtimex (64-bit)" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: -a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*adjtimex
file: /etc/audit/audit.rules
regex: -a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*adjtimex
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*adjtimex"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*adjtimex"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>6e2ad8f0439fb2d4a04ac3cdf0f5db2e235296d8aef9c0fab064c32e219ebab7</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - adjtimex (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: -a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*adjtimex
file: /etc/audit/audit.rules
regex: -a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*adjtimex
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - clock_settime (64-bit)" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: -a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*clock_settime
file: /etc/audit/audit.rules
regex: -a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*clock_settime
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*clock_settime"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*clock_settime"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>f90a0e9dce9450ed4f31eda16f406eb2471769fe1a80b1c62cbadaa34207a34d</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - clock_settime (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: -a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*clock_settime
file: /etc/audit/audit.rules
regex: -a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+.*clock_settime
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - /etc/group" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/etc\/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b31c7ecc03eec809270d0771b0c8cb5604d6f4606cd9962d50d0868b69451237</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - /etc/group</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/etc\/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/group" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>f992026cf97ff0cc3205f67b112e45cf7432da5e21e155ffa062907a996d07a2</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/group</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/group[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - /etc/passwd" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/etc\/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>c4225ffe1dc7f8b04ea520c2933cd151af3acc65e68f7b0aab904a33910728cb</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - /etc/passwd</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/etc\/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/passwd" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e771db8e6788e6fdc4d3a597670422a314a7c68d376405d8ecd409a4988452fd</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/passwd</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/passwd[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - /etc/gshadow" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/etc\/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>ad9bbec9aefae616eaf490912d1dfc8e1174da53045878503970261b0900fcd9</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - /etc/gshadow</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/etc\/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/gshadow" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>9107757c81c15efbbf8a5d6c0f00878c037f79bf972e7d96ba41211f5bd3e00c</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/gshadow</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/gshadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - /etc/shadow" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/etc\/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>936f891dfe1a0d5ea0917dcf9e4c56066c9159f8662f7390b7d5d59ecb844272</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - /etc/shadow</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/etc\/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/shadow" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b6b70b67ef4e2556956c13264699d60e45aec6399aea37d149d7b2a0b33c4bf3</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/shadow</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/shadow[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - /etc/security/opasswd" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/etc\/security\/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/security\/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/security\/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/security\/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>2f3f4a76f9880bea92989e7caa0afd0d26c00b1e73ae19666df23e1b7c3fe57a</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - /etc/security/opasswd</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/etc\/security\/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/security\/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/security/opasswd" : [FAILED]

Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/security/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/security/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/security/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>9d5d30d175370be54d1f830b7c7d3965c9c1306a0caf83044fa60f98eeb8a0a1</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/security/opasswd</cm:compliance-check-name>
        <cm:compliance-info>Record events affecting the group , passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier 'identity' in the audit log file.

Rationale:

Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/security/opasswd[\s]+-p[\s]+wa[\s]+-k[\s]+identity$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/identity.rules
and add the following lines:

-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - sethostname (32-bit)" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>0420b9df8b56be058851e1b46fd032f9bd3bde339f6b4c156a7ea324009295d4</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - sethostname (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - auditctl sethostname (32-bit)" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*sethostname)(?=.*setdomainname).*-F[\s]+key=system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*sethostname)(?=.*setdomainname).*-F[\s]+key=system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*sethostname)(?=.*setdomainname).*-F[\s]+key=system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>4c7a06c32c59688deb682e545cab38af927004d77a43e117345f666e7417c398</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - auditctl sethostname (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*sethostname)(?=.*setdomainname).*-F[\s]+key=system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - issue" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/etc\/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>a4627cee557446d2e1af27364b89c81b8214345ff4cc59e2e983a5c0d559d6ec</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - issue</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/etc\/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - auditctl issue" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>d4f8c013750a1db1505dfc0e5d8998d672c90caa1f796bf1f2468ac91ed0fb44</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - auditctl issue</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/issue[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - issue.net" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/etc/issue\.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/issue\.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/issue\.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/issue\.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b0bac992a93d7597d9b1c6c3459b8cff3e6f268ef7b8ff65df7b3a87164b5059</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - issue.net</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/etc/issue\.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/issue\.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - auditctl issue.net" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/issue.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/issue.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/issue.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5c19eed8ec5c51fff27ba1718811b14292012c1ebf6c9b95315ecff1f45ec8b9</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - auditctl issue.net</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/issue.net[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - /etc/hosts" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>de728ffbc8b0efcf9e36595a1d10763638e77abd0175917dc8f1766eb865c4cb</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - /etc/hosts</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - auditctl hosts" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1780c1a10342cecf2f612ea67cf848a1bed2d0b7f96c99ce45ee8d1d676c56c0</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - auditctl hosts</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/hosts[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - /etc/network" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>4dd1d3e582c76c6eabd1a2c47b3089fa19de4bfabfe56c9b76c277c20df633c7</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - /etc/network</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - auditctl network" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>3e9a4f4ccf9b5f576402bbbfca100daf55f08c91c39be9397e84dde2eba4e1ec</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - auditctl network</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/network[\s]+-p[\s]+wa[\s]+-k[\s]+system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - sethostname (64-bit)" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1e7a5952df1e4ee4a598e84fc4f102e2d5053175e70f9a7b129f1a5c2babf2b6</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - sethostname (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+sethostname[\s]+-S[\s]+setdomainname[\s]+-k[\s]+system-locale[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.5 Ensure events that modify the system's network environment are collected - auditctl sethostname (64-bit)" : [FAILED]

Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*sethostname)(?=.*setdomainname).*-F[\s]+key=system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*sethostname)(?=.*setdomainname).*-F[\s]+key=system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*sethostname)(?=.*setdomainname).*-F[\s]+key=system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>98a0ebf0015ed7c023df1b273dfeb0da2ccfd9588cd207f10c2363a30e9be3f0</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.5 Ensure events that modify the system's network environment are collected - auditctl sethostname (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.net files (messages displayed pre-login), /etc/hosts (file containing host names and associated IP addresses) and /etc/network (directory containing network interface scripts and configurations) files.

Rationale:

Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into those files and trick users into providing information to the intruder. Monitoring /etc/network is important as it can show if network interfaces or scripts are being modified in a way that can lead to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier 'system-locale.'</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*sethostname)(?=.*setdomainname).*-F[\s]+key=system-locale$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/system-locale.rules
and add the following lines:

-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor/" : [FAILED]

Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.

Rationale:

Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/MAC-policy.rules
and add the following lines:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/etc/apparmor/[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/apparmor/[\s]+-p[\s]+wa[\s]+-k[\s]
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/apparmor/[\s]+-p[\s]+wa[\s]+-k[\s]"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/apparmor/[\s]+-p[\s]+wa[\s]+-k[\s]"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>6bd95d1d5d7bb72928b49fe6576b9c7dcb81435662c7afb0e280f5bd51bb1ceb</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor/</cm:compliance-check-name>
        <cm:compliance-info>Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.

Rationale:

Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/etc/apparmor/[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/apparmor/[\s]+-p[\s]+wa[\s]+-k[\s]
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/MAC-policy.rules
and add the following lines:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/apparmor/" : [FAILED]

Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.

Rationale:

Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/MAC-policy.rules
and add the following lines:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/apparmor/?[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/apparmor/?[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/apparmor/?[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>2ddfce8b96fae8514b37579579cc75c0a5c5f6182a479944134de370fbec8fed</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/apparmor/</cm:compliance-check-name>
        <cm:compliance-info>Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.

Rationale:

Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/apparmor/?[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/MAC-policy.rules
and add the following lines:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor.d/" : [FAILED]

Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.

Rationale:

Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/MAC-policy.rules
and add the following lines:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/etc/apparmor.d/[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/apparmor.d/[\s]+-p[\s]+wa[\s]+-k[\s]
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/apparmor.d/[\s]+-p[\s]+wa[\s]+-k[\s]"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc/apparmor.d/[\s]+-p[\s]+wa[\s]+-k[\s]"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>6105b9523a81171ea54322d658ca1fd99a26a57eb878563ac6f6bd768a136b97</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/apparmor.d/</cm:compliance-check-name>
        <cm:compliance-info>Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.

Rationale:

Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/etc/apparmor.d/[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc/apparmor.d/[\s]+-p[\s]+wa[\s]+-k[\s]
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/MAC-policy.rules
and add the following lines:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/apparmor.d/" : [FAILED]

Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.

Rationale:

Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/MAC-policy.rules
and add the following lines:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/apparmor.d[/]?[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/apparmor.d[/]?[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/apparmor.d[/]?[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b7ef7c8286a7e4ef03d78673eced8b82b2353009cda557ccbca8f56501148434</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/apparmor.d/</cm:compliance-check-name>
        <cm:compliance-info>Monitor AppArmor mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to /etc/apparmor and /etc/apparmor.d directories.

Rationale:

Changes to files in these directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/etc/apparmor.d[/]?[\s]+-p[\s]+wa[\s]+-k[\s]+MAC-policy$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/MAC-policy.rules
and add the following lines:

-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.7 Ensure login and logout events are collected - /var/log/lastlog" : [FAILED]

Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>11e3dbacda852bfa703326b36102e26f28cfa54ba9a3639ceb120ad3e34acda5</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.7 Ensure login and logout events are collected - /var/log/lastlog</cm:compliance-check-name>
        <cm:compliance-info>Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.7 Ensure login and logout events are collected - auditctl /var/log/lastlog" : [FAILED]

Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>7ab0bd3f92d264704402b1bd7557aeb927c6ee304d2c675fa3a533d17340bab0</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.7 Ensure login and logout events are collected - auditctl /var/log/lastlog</cm:compliance-check-name>
        <cm:compliance-info>Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/lastlog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.7 Ensure login and logout events are collected - /var/log/faillog" : [FAILED]

Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>a0475517601e550f306cb5fc117f94884adc3d2d0a27bfceec74926236d07c31</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.7 Ensure login and logout events are collected - /var/log/faillog</cm:compliance-check-name>
        <cm:compliance-info>Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.7 Ensure login and logout events are collected - auditctl /var/log/faillog" : [FAILED]

Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>897994af1adf891d3ec6320e2e2c7ce99413c1004c126251ddb453a345248d1f</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.7 Ensure login and logout events are collected - auditctl /var/log/faillog</cm:compliance-check-name>
        <cm:compliance-info>Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/faillog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.7 Ensure login and logout events are collected - /var/log/tallylog" : [FAILED]

Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>f4c95ac4492bc2fd3b42c854b99d763c1092e372cb5c3dc8e73f2f53d2f18974</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.7 Ensure login and logout events are collected - /var/log/tallylog</cm:compliance-check-name>
        <cm:compliance-info>Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.7 Ensure login and logout events are collected - auditctl /var/log/tallylog" : [FAILED]

Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>2a20560c097b3583fc8ae4a9f4a4f81ccd115ce1d577cacb7a3d5bce2b0bb38b</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.7 Ensure login and logout events are collected - auditctl /var/log/tallylog</cm:compliance-check-name>
        <cm:compliance-info>Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module

Rationale:

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/tallylog[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/logins.rules
and add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.8 Ensure session initiation information is collected - utmp" : [FAILED]

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e0e32c7abaa520af57d5fcd0509af4efd600d0fe6194e88bfd070eeb0b7c32f2</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.8 Ensure session initiation information is collected - utmp</cm:compliance-check-name>
        <cm:compliance-info>Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.8 Ensure session initiation information is collected - auditctl utmp" : [FAILED]

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>334856ae21edbfc8e4ee69474e5162330346bb8eb005bf32c71230ef47e269e7</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.8 Ensure session initiation information is collected - auditctl utmp</cm:compliance-check-name>
        <cm:compliance-info>Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/run/utmp[\s]+-p[\s]+wa[\s]+-k[\s]+session$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.8 Ensure session initiation information is collected - wtmp" : [FAILED]

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/var\/log\/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/var\/log\/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/var\/log\/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/var\/log\/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5d42e9edf7128427652c2d26d8071dbe75373a4cdee761a506b1e9a4342ee0cd</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.8 Ensure session initiation information is collected - wtmp</cm:compliance-check-name>
        <cm:compliance-info>Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/var\/log\/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/var\/log\/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.8 Ensure session initiation information is collected - auditctl wtmp" : [FAILED]

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>778fcea391b5dcbd7e4e9d94f0041c11506ff1b24e4ec11d2ea035069bc4380e</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.8 Ensure session initiation information is collected - auditctl wtmp</cm:compliance-check-name>
        <cm:compliance-info>Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/wtmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.8 Ensure session initiation information is collected - btmp" : [FAILED]

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/var\/log\/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/var\/log\/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/var\/log\/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/var\/log\/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5b94974042792bdc279a8e5a10036b5991f126f79e06946a7efaea572d31b3bf</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.8 Ensure session initiation information is collected - btmp</cm:compliance-check-name>
        <cm:compliance-info>Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/var\/log\/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/var\/log\/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.8 Ensure session initiation information is collected - auditctl btmp" : [FAILED]

Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.5,CSCv7|16.11,CSCv7|16.13,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>ef94c6dcf22a4f89985b81b0e6a565bbbdc4d9e9f1c29468d31dc32bf24b6a1d</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.8 Ensure session initiation information is collected - auditctl btmp</cm:compliance-check-name>
        <cm:compliance-info>Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp tracks all currently logged in users. All audit records will be tagged with the identifier 'session.' The /var/log/wtmp file tracks logins, logouts, shutdown, and reboot events. The file /var/log/btmp keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp . All audit records will be tagged with the identifier 'logins.'

Rationale:

Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+/var/log/btmp[\s]+-p[\s]+wa[\s]+-k[\s]+logins$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.5, CSCv7|16.11, CSCv7|16.13, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/session.rules
and add the following lines:

-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins

Notes:

The last command can be used to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>ed612d721cb76e091a63409120de4a8eb33983a648ac29cfe81e1c362ef0881d</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*chmod)(?=.*fchmod)(?=.*fchmodat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*chmod)(?=.*fchmod)(?=.*fchmodat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*chmod)(?=.*fchmod)(?=.*fchmodat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>8f3913220ffa84f56d1246020c38b12f7ca4319180661291865bd8eaf2a4282e</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*chmod)(?=.*fchmod)(?=.*fchmodat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b240407faf92342c6c14680877ee59d28c2ced52e61d3c1fbb39ad29b3be3527</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*chown)(?=.*fchown)(?=.*fchownat)(?=.*lchown).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*chown)(?=.*fchown)(?=.*fchownat)(?=.*lchown).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*chown)(?=.*fchown)(?=.*fchownat)(?=.*lchown).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5433cc45f04c9d8dc054f61f8ed24e857d5ac8a2c9f389d40a50e60326c1145a</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*chown)(?=.*fchown)(?=.*fchownat)(?=.*lchown).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>8bace636fd3d0ee4af88ffd2071c61dc69517fa01f308d6d7aac72e8f0d828ef</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s](?=.*setxattr)(?=.*lsetxattr)(?=.*fsetxattr)(?=.*removexattr)(?=.*lremovexattr)(?=.*fremovexattr).*[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s](?=.*setxattr)(?=.*lsetxattr)(?=.*fsetxattr)(?=.*removexattr)(?=.*lremovexattr)(?=.*fremovexattr).*[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s](?=.*setxattr)(?=.*lsetxattr)(?=.*fsetxattr)(?=.*removexattr)(?=.*lremovexattr)(?=.*fremovexattr).*[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>62ce63cf9c422074f5f884cc643c35470363c956e7882ed2a99f6cb2cfa7d473</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s](?=.*setxattr)(?=.*lsetxattr)(?=.*fsetxattr)(?=.*removexattr)(?=.*lremovexattr)(?=.*fremovexattr).*[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat (64-bit)" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>0df8a92a377f538eda7d6d72950db31248cedf3888d8f7814e5cd9641421a0bc</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chmod[\s]+-S[\s]+fchmod[\s]+-S[\s]+fchmodat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat (64-bit)" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*chmod)(?=.*fchmod)(?=.*fchmodat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*chmod)(?=.*fchmod)(?=.*fchmodat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*chmod)(?=.*fchmod)(?=.*fchmodat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>2cb128c8490dc349fd5f43a1e18b6fd5b909860ff92287ff0291ce89870823fd</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*chmod)(?=.*fchmod)(?=.*fchmodat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown (64-bit)" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>ff4d64871baeccb6b463a35ebd3299858b02f3396814c4cc063edcec9bb16f30</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+chown[\s]+-S[\s]+fchown[\s]+-S[\s]+fchownat[\s]+-S[\s]+lchown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown (64-bit)" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*chown)(?=.*fchown)(?=.*fchownat)(?=.*lchown).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*chown)(?=.*fchown)(?=.*fchownat)(?=.*lchown).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*chown)(?=.*fchown)(?=.*fchownat)(?=.*lchown).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>0efe00fae162ed63d3a7a1f7d308be5bf43950104f0262044cfc67e0a405ba25</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*chown)(?=.*fchown)(?=.*fchownat)(?=.*lchown).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - xattr (64-bit)" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>cd8157063033a8ee2c02be626b5398d6afe880168114e845196c9f105bc8e0c6</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - xattr (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+perm_mod[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+setxattr[\s]+-S[\s]+lsetxattr[\s]+-S[\s]+fsetxattr[\s]+-S[\s]+removexattr[\s]+-S[\s]+lremovexattr[\s]+-S[\s]+fremovexattr[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.9 Ensure discretionary access control permission modification events are collected - auditctl xattr (64-bit)" : [FAILED]

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*setxattr)(?=.*lsetxattr)(?=.*fsetxattr)(?=.*removexattr)(?=.*lremovexattr)(?=.*fremovexattr).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*setxattr)(?=.*lsetxattr)(?=.*fsetxattr)(?=.*removexattr)(?=.*lremovexattr)(?=.*fremovexattr).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*setxattr)(?=.*lsetxattr)(?=.*fsetxattr)(?=.*removexattr)(?=.*lremovexattr)(?=.*fremovexattr).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>0c37fb782e57215ee0d927c44e3ce193449ccb56b406724c084772023fdb8be3</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.9 Ensure discretionary access control permission modification events are collected - auditctl xattr (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod , fchmod and fchmodat system calls affect the permissions associated with a file. The chown , fchown , fchownat and lchown system calls affect owner and group attributes on a file. The setxattr , lsetxattr , fsetxattr (set extended file attributes) and removexattr , lremovexattr , fremovexattr (remove extended file attributes) control extended file attributes. In all cases, an audit record will only be written for non-system user ids (auid >= 1000) and will ignore Daemon events (auid = 4294967295). All audit records will be tagged with the identifier 'perm_mod.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*setxattr)(?=.*lsetxattr)(?=.*fsetxattr)(?=.*removexattr)(?=.*lremovexattr)(?=.*fremovexattr).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=perm_mod$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3.6, CSCv7|5.5, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/perm_mod.rules
and add the following lines:

-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EACCES" : [FAILED]

Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|14.6,CSCv7|14.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>c43555aef0dbf51050493b49ee3f20e5ef50c2237c34dcf2d6c0603971ccc093</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EACCES</cm:compliance-check-name>
        <cm:compliance-info>Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|14.6, CSCv7|14.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES" : [FAILED]

Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|14.6,CSCv7|14.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b3caa9146de0f5959793e2ccad56b548524aa36c1c2601d3fa415655ccf90923</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES</cm:compliance-check-name>
        <cm:compliance-info>Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|14.6, CSCv7|14.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EPERM" : [FAILED]

Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|14.6,CSCv7|14.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>bf99c3878172804505f3bc5c0fd73b06da8420e24c756fb7f3f40e0141393433</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EPERM</cm:compliance-check-name>
        <cm:compliance-info>Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|14.6, CSCv7|14.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM" : [FAILED]

Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|14.6,CSCv7|14.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=(i386|b32)[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=(i386|b32)[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=(i386|b32)[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>cefb7ab557baa40a03012af96f8b142c4308f9ae3dc7fb829109c856785412f1</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM</cm:compliance-check-name>
        <cm:compliance-info>Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=(i386|b32)[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|14.6, CSCv7|14.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EACCES (64-bit)" : [FAILED]

Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|14.6,CSCv7|14.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e4c1eedd2a3bbb88dbd046bd31d3e5476ab90c15cec8eaa13bd186d00ff57272</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EACCES (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|14.6, CSCv7|14.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES (64-bit)" : [FAILED]

Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|14.6,CSCv7|14.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>2395aa07f0abf9761dd934e48a53afa6f8071b84c709dfb525ff3f9e43623ead</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EACCES[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|14.6, CSCv7|14.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EPERM (64-bit)" : [FAILED]

Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|14.6,CSCv7|14.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>08e70e7093244321f07b8371516d57c030c72313285a69200b865f0d8eb35910</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EPERM (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+creat[\s]+-S[\s]+open[\s]+-S[\s]+openat[\s]+-S[\s]+truncate[\s]+-S[\s]+ftruncate[\s]+-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+access[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|14.6, CSCv7|14.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM (64-bit)" : [FAILED]

Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|14.6,CSCv7|14.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5e0c411a1e9c2491ff606cba6d8c821e12affc82cfd65c4977376362fd8e83dd</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation ( creat ), opening ( open , openat ) and truncation ( truncate , ftruncate ) of files. An audit log record will only be written if the user is a non-privileged user (auid > = 1000), is not a Daemon event (auid=4294967295) and if the system call returned EACCES (permission denied to the file) or EPERM (some other permanent error associated with the specific system call). All audit records will be tagged with the identifier 'access.'

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*open)(?=.*truncate)(?=.*creat)(?=.*ftruncate)(?=.*openat).*-F[\s]+exit=-EPERM[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=access$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|14.6, CSCv7|14.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/access.rules
and add the following lines:

-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.11 Ensure use of privileged commands is collected" : [FAILED]

Monitor privileged programs (those that have the setuid and/or setgid bit set on execution) to determine if unprivileged users are running these commands.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Execution of privileged commands by non-privileged users could be an indication of someone trying to gain unauthorized access to the system.

Solution:
To remediate this issue, the system administrator will have to execute a find command to locate all the privileged programs and then add an audit line for each one of them. The audit parameters associated with this are as follows:
-F path=' $1 ' - will populate each file name found through the find command and processed by awk. -F perm=x - will write an audit record if the file is executed. -F auid>=1000 - will write a record if the user executing the command is not a privileged user. -F auid!= 4294967295 - will ignore Daemon events
All audit records should be tagged with the identifier 'privileged'.
Run the following command replacing with a list of partitions where programs can be executed from on your system:

# find &lt;partition> -xdev ( -perm -4000 -o -perm -2000 ) -type f | awk '{print 
'-a always,exit -F path=' $1 ' -F perm=x -F auid>=1000 -F auid!=4294967295 
-k privileged' }'

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/privileged.rules
And add all resulting lines to the file.

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.1.7,800-53|AC-6(10),CSCv6|5.1,CSCv7|5.1,CSF|PR.AC-4,LEVEL|2S,QCSC-v1|5.2.2,QCSC-v1|6.2

Policy Value:
cmd: IFS=$''; LINES=$(find / -xdev \( -perm -4000 -o -perm -2000 \) -type f); for LINE in $LINES; do LINE="-a always,exit -F path=$LINE -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged"; if [ $(grep -- "$LINE" /etc/audit/rules.d/*.rules | wc -l) -eq 0 ] ; then echo "$LINE - not found in /etc/audit/rules.d/"; fi; done
dont_echo_cmd: YES
not_expect: not found
system: Linux

Actual Value:
The command returned : 

-a always,exit -F path=/opt/threatstack/sbin/tsfim
/opt/threatstack/sbin/tsauditd
/opt/threatstack/sbin/tsagentd
/opt/threatstack/sbin/raudit
/usr/lib/openssh/ssh-keysign
/usr/lib/snapd/snap-confine
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/x86_64-linux-gnu/utempter/utempter
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/pkexec
/usr/bin/bsd-write
/usr/bin/expiry
/usr/bin/chage
/usr/bin/chfn
/usr/bin/traceroute6.iputils
/usr/bin/crontab
/usr/bin/at
/usr/bin/sudo
/usr/bin/gpasswd
/usr/bin/ssh-agent
/usr/bin/chsh
/usr/bin/mlocate
/usr/bin/wall
/sbin/unix_chkpwd
/sbin/pam_extrausers_chkpwd
/bin/mount
/bin/su
/bin/umount
/bin/ping
/bin/fusermount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged - not found in /etc/audit/rules.d/</description>
        <cm:compliance-actual-value>The command returned : 

-a always,exit -F path=/opt/threatstack/sbin/tsfim
/opt/threatstack/sbin/tsauditd
/opt/threatstack/sbin/tsagentd
/opt/threatstack/sbin/raudit
/usr/lib/openssh/ssh-keysign
/usr/lib/snapd/snap-confine
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/x86_64-linux-gnu/utempter/utempter
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/pkexec
/usr/bin/bsd-write
/usr/bin/expiry
/usr/bin/chage
/usr/bin/chfn
/usr/bin/traceroute6.iputils
/usr/bin/crontab
/usr/bin/at
/usr/bin/sudo
/usr/bin/gpasswd
/usr/bin/ssh-agent
/usr/bin/chsh
/usr/bin/mlocate
/usr/bin/wall
/sbin/unix_chkpwd
/sbin/pam_extrausers_chkpwd
/bin/mount
/bin/su
/bin/umount
/bin/ping
/bin/fusermount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged - not found in /etc/audit/rules.d/</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>293349b070010c7e68206a4468974e29b921c4dd13799a9fcfdf8db0e3baf248</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.11 Ensure use of privileged commands is collected</cm:compliance-check-name>
        <cm:compliance-info>Monitor privileged programs (those that have the setuid and/or setgid bit set on execution) to determine if unprivileged users are running these commands.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Execution of privileged commands by non-privileged users could be an indication of someone trying to gain unauthorized access to the system.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: IFS=$''; LINES=$(find / -xdev \( -perm -4000 -o -perm -2000 \) -type f); for LINE in $LINES; do LINE="-a always,exit -F path=$LINE -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged"; if [ $(grep -- "$LINE" /etc/audit/rules.d/*.rules | wc -l) -eq 0 ] ; then echo "$LINE - not found in /etc/audit/rules.d/"; fi; done
dont_echo_cmd: YES
not_expect: not found
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.1.7, 800-53|AC-6(10), CSCv6|5.1, CSCv7|5.1, CSF|PR.AC-4, LEVEL|2S, QCSC-v1|5.2.2, QCSC-v1|6.2</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>To remediate this issue, the system administrator will have to execute a find command to locate all the privileged programs and then add an audit line for each one of them. The audit parameters associated with this are as follows:
-F path=' $1 ' - will populate each file name found through the find command and processed by awk. -F perm=x - will write an audit record if the file is executed. -F auid>=1000 - will write a record if the user executing the command is not a privileged user. -F auid!= 4294967295 - will ignore Daemon events
All audit records should be tagged with the identifier 'privileged'.
Run the following command replacing with a list of partitions where programs can be executed from on your system:

# find &lt;partition> -xdev ( -perm -4000 -o -perm -2000 ) -type f | awk '{print 
'-a always,exit -F path=' $1 ' -F perm=x -F auid>=1000 -F auid!=4294967295 
-k privileged' }'

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/privileged.rules
And add all resulting lines to the file.

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.12 Ensure successful file system mounts are collected - 32-bit" : [FAILED]

Monitor the use of the mount system call. The mount (and umount ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open , creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/mounts.rules
and add the following lines:

-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

Notes:

This tracks successful and unsuccessful mount commands. File system mounts do not have to come from external media and this action still does not verify write (e.g. CD ROMS).

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.1,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>507850f012ae2f026e5da7ae28cb529fa8dc8e011c9075b8a344e04be97c136e</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.12 Ensure successful file system mounts are collected - 32-bit</cm:compliance-check-name>
        <cm:compliance-info>Monitor the use of the mount system call. The mount (and umount ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open , creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.1, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/mounts.rules
and add the following lines:

-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

Notes:

This tracks successful and unsuccessful mount commands. File system mounts do not have to come from external media and this action still does not verify write (e.g. CD ROMS).

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.12 Ensure successful file system mounts are collected - auditctl (32-bit)" : [FAILED]

Monitor the use of the mount system call. The mount (and umount ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open , creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/mounts.rules
and add the following lines:

-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

Notes:

This tracks successful and unsuccessful mount commands. File system mounts do not have to come from external media and this action still does not verify write (e.g. CD ROMS).

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|13,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=mounts$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=mounts$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=mounts$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>35f9902a028545a929c9e4b2d8182848d5cf7af326e9ce8b34cdc98b8de923f1</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.12 Ensure successful file system mounts are collected - auditctl (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor the use of the mount system call. The mount (and umount ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open , creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=mounts$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|13, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/mounts.rules
and add the following lines:

-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

Notes:

This tracks successful and unsuccessful mount commands. File system mounts do not have to come from external media and this action still does not verify write (e.g. CD ROMS).

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.12 Ensure successful file system mounts are collected - 64-bit" : [FAILED]

Monitor the use of the mount system call. The mount (and umount ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open , creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/mounts.rules
and add the following lines:

-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

Notes:

This tracks successful and unsuccessful mount commands. File system mounts do not have to come from external media and this action still does not verify write (e.g. CD ROMS).

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|13,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>ec348285db8173a031444fde71da70cc9af348e5d5844414723d00f5b06ac0e3</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.12 Ensure successful file system mounts are collected - 64-bit</cm:compliance-check-name>
        <cm:compliance-info>Monitor the use of the mount system call. The mount (and umount ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open , creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+mounts[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|13, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/mounts.rules
and add the following lines:

-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

Notes:

This tracks successful and unsuccessful mount commands. File system mounts do not have to come from external media and this action still does not verify write (e.g. CD ROMS).

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.12 Ensure successful file system mounts are collected - auditctl (64-bit)" : [FAILED]

Monitor the use of the mount system call. The mount (and umount ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open , creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/mounts.rules
and add the following lines:

-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

Notes:

This tracks successful and unsuccessful mount commands. File system mounts do not have to come from external media and this action still does not verify write (e.g. CD ROMS).

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|13,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=mounts$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=mounts$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=mounts$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>4e1f48102917b94e03671569ced1ed5f2e12c75dbc073559273ebb87440f9502</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.12 Ensure successful file system mounts are collected - auditctl (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor the use of the mount system call. The mount (and umount ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open , creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=mounts$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|13, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/mounts.rules
and add the following lines:

-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts

Notes:

This tracks successful and unsuccessful mount commands. File system mounts do not have to come from external media and this action still does not verify write (e.g. CD ROMS).

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.13 Ensure file deletion events by users are collected - 32-bit" : [FAILED]

Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for the unlink (remove a file), unlinkat (remove a file attribute), rename (rename a file) and renameat (rename a file attribute) system calls and tags them with the identifier 'delete'.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/delete.rules
and add the following lines:

-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

Notes:

At a minimum, configure the audit system to collect file deletion events for all users and root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|13,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>c4c538eb0d9adc4e1b9f3f040c5dbebf537f24581faf5d3e97c6e405773b7171</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.13 Ensure file deletion events by users are collected - 32-bit</cm:compliance-check-name>
        <cm:compliance-info>Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for the unlink (remove a file), unlinkat (remove a file attribute), rename (rename a file) and renameat (rename a file attribute) system calls and tags them with the identifier 'delete'.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv7|13, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/delete.rules
and add the following lines:

-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

Notes:

At a minimum, configure the audit system to collect file deletion events for all users and root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.13 Ensure file deletion events by users are collected - auditctl (32-bit)" : [FAILED]

Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for the unlink (remove a file), unlinkat (remove a file attribute), rename (rename a file) and renameat (rename a file attribute) system calls and tags them with the identifier 'delete'.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/delete.rules
and add the following lines:

-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

Notes:

At a minimum, configure the audit system to collect file deletion events for all users and root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|13,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*rename)(?=.*unlink)(?=.*unlinkat)(?=.*renameat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=delete$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*rename)(?=.*unlink)(?=.*unlinkat)(?=.*renameat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=delete$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*rename)(?=.*unlink)(?=.*unlinkat)(?=.*renameat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=delete$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>18496caba825b6b3b7aba408aa2fdd82264037b1571d232ef605c9d8cfd83682</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.13 Ensure file deletion events by users are collected - auditctl (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for the unlink (remove a file), unlinkat (remove a file attribute), rename (rename a file) and renameat (rename a file attribute) system calls and tags them with the identifier 'delete'.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*rename)(?=.*unlink)(?=.*unlinkat)(?=.*renameat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=delete$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv7|13, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/delete.rules
and add the following lines:

-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

Notes:

At a minimum, configure the audit system to collect file deletion events for all users and root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.13 Ensure file deletion events by users are collected - 64-bit" : [FAILED]

Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for the unlink (remove a file), unlinkat (remove a file attribute), rename (rename a file) and renameat (rename a file attribute) system calls and tags them with the identifier 'delete'.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/delete.rules
and add the following lines:

-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

Notes:

At a minimum, configure the audit system to collect file deletion events for all users and root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|13,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>7f02e4367d27f7b08950a84fe787f594ee41e6087a948c2e6048dce565702def</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.13 Ensure file deletion events by users are collected - 64-bit</cm:compliance-check-name>
        <cm:compliance-info>Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for the unlink (remove a file), unlinkat (remove a file attribute), rename (rename a file) and renameat (rename a file attribute) system calls and tags them with the identifier 'delete'.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+unlink[\s]+-S[\s]+unlinkat[\s]+-S[\s]+rename[\s]+-S[\s]+renameat[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=4294967295[\s]+-k[\s]+delete[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv7|13, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/delete.rules
and add the following lines:

-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

Notes:

At a minimum, configure the audit system to collect file deletion events for all users and root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.13 Ensure file deletion events by users are collected - auditctl (64-bit)" : [FAILED]

Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for the unlink (remove a file), unlinkat (remove a file attribute), rename (rename a file) and renameat (rename a file attribute) system calls and tags them with the identifier 'delete'.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/delete.rules
and add the following lines:

-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

Notes:

At a minimum, configure the audit system to collect file deletion events for all users and root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|13,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*rename)(?=.*unlink)(?=.*unlinkat)(?=.*renameat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=delete$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*rename)(?=.*unlink)(?=.*unlinkat)(?=.*renameat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=delete$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*rename)(?=.*unlink)(?=.*unlinkat)(?=.*renameat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=delete$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>29fa10a71ae56832ee59df1f6c16f0ca28c3a06b7f70ed10b38dbe8af2770969</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.13 Ensure file deletion events by users are collected - auditctl (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for the unlink (remove a file), unlinkat (remove a file attribute), rename (rename a file) and renameat (rename a file attribute) system calls and tags them with the identifier 'delete'.

Note: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:

# awk '/^s*UID_MIN/{print $2}' /etc/login.defs

If your systems' UID_MIN is not 1000, replace audit>=1000 with audit>=&lt;UID_MIN for your system> in the Audit and Remediation procedures.

Rationale:

Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*rename)(?=.*unlink)(?=.*unlinkat)(?=.*renameat).*-F[\s]+auid>=1000[\s]+-F[\s]+auid!=-1[\s]+-F[\s]+key=delete$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv7|13, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/audit.rules
and add the following lines:

-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/delete.rules
and add the following lines:

-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

Notes:

At a minimum, configure the audit system to collect file deletion events for all users and root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.14 Ensure changes to system administration scope (sudoers) is collected - sudoers" : [FAILED]

Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier 'scope.'

Rationale:

Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/scope.rules
and add the following lines:

-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e8fef2d63fce68b3aebdf87672f23f44b82784ec90d5cb5d7487085164337768</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.14 Ensure changes to system administration scope (sudoers) is collected - sudoers</cm:compliance-check-name>
        <cm:compliance-info>Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier 'scope.'

Rationale:

Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/scope.rules
and add the following lines:

-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.14 Ensure changes to system administration scope (sudoers) is collected - auditctl sudoers" : [FAILED]

Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier 'scope.'

Rationale:

Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/scope.rules
and add the following lines:

-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>6c9565caf492ae04a934479f78d8dfec3cd8319153c6414eeb016504eab9a8cc</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.14 Ensure changes to system administration scope (sudoers) is collected - auditctl sudoers</cm:compliance-check-name>
        <cm:compliance-info>Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier 'scope.'

Rationale:

Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/sudoers[\s]+-p[\s]+wa[\s]+-k[\s]+scope$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/scope.rules
and add the following lines:

-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.14 Ensure changes to system administration scope (sudoers) is collected - sudoers.d" : [FAILED]

Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier 'scope.'

Rationale:

Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/scope.rules
and add the following lines:

-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>17db8c79852c4ffca552336921bdb821d619b8eaa1aa78a63febe192a38fc63d</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.14 Ensure changes to system administration scope (sudoers) is collected - sudoers.d</cm:compliance-check-name>
        <cm:compliance-info>Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier 'scope.'

Rationale:

Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/scope.rules
and add the following lines:

-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.14 Ensure changes to system administration scope (sudoers) is collected - auditctl sudoers.d" : [FAILED]

Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier 'scope.'

Rationale:

Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/scope.rules
and add the following lines:

-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.4,CSCv7|4.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>eb02bf62db0abc558120b5c2615efe2911761a7c01d578405de0c1ac1c05bd93</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.14 Ensure changes to system administration scope (sudoers) is collected - auditctl sudoers.d</cm:compliance-check-name>
        <cm:compliance-info>Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier 'scope.'

Rationale:

Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/etc\/sudoers\.d\/?[\s]+-p[\s]+wa[\s]+-k[\s]+scope$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.4, CSCv7|4.8, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/scope.rules
and add the following lines:

-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.15 Ensure system administrator actions (sudolog) are collected" : [FAILED]

Monitor the sudo log file. If the system has been properly configured to disable the use of the su command and force all administrators to have to log in first and then use sudo to execute privileged commands, then all administrator commands will be logged to /var/log/sudo.log . Any time a command is executed, an audit event will be triggered as the /var/log/sudo.log file will be opened for write and the executed administration command will be written to the log.

Rationale:

Changes in /var/log/sudo.log indicate that an administrator has executed a command or the log file itself has been tampered with. Administrators will want to correlate the events written to the audit trail with the records written to /var/log/sudo.log to verify if unauthorized commands have been executed.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules and add the following line:

-w &lt;Path to sudo logfile> -p wa -k actions

Example: vi /etc/audit/rules.d/actions.rules
and add the following line:

-w /var/log/sudo.log -p wa -k actions

Notes:

The system must be configured with su disabled (See Item 5.6 Ensure access to the su command is restricted) to force all command execution through sudo. This will not be effective on the console, as administrators can log in as root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.1,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b2803cc5e0e322fccb3bb2ca3cfea7299471320ff54cdf6d3d9f001295058e00</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.15 Ensure system administrator actions (sudolog) are collected</cm:compliance-check-name>
        <cm:compliance-info>Monitor the sudo log file. If the system has been properly configured to disable the use of the su command and force all administrators to have to log in first and then use sudo to execute privileged commands, then all administrator commands will be logged to /var/log/sudo.log . Any time a command is executed, an audit event will be triggered as the /var/log/sudo.log file will be opened for write and the executed administration command will be written to the log.

Rationale:

Changes in /var/log/sudo.log indicate that an administrator has executed a command or the log file itself has been tampered with. Administrators will want to correlate the events written to the audit trail with the records written to /var/log/sudo.log to verify if unauthorized commands have been executed.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.1, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules and add the following line:

-w &lt;Path to sudo logfile> -p wa -k actions

Example: vi /etc/audit/rules.d/actions.rules
and add the following line:

-w /var/log/sudo.log -p wa -k actions

Notes:

The system must be configured with su disabled (See Item 5.6 Ensure access to the su command is restricted) to force all command execution through sudo. This will not be effective on the console, as administrators can log in as root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.15 Ensure system administrator actions (sudolog) are collected - auditctl" : [FAILED]

Monitor the sudo log file. If the system has been properly configured to disable the use of the su command and force all administrators to have to log in first and then use sudo to execute privileged commands, then all administrator commands will be logged to /var/log/sudo.log . Any time a command is executed, an audit event will be triggered as the /var/log/sudo.log file will be opened for write and the executed administration command will be written to the log.

Rationale:

Changes in /var/log/sudo.log indicate that an administrator has executed a command or the log file itself has been tampered with. Administrators will want to correlate the events written to the audit trail with the records written to /var/log/sudo.log to verify if unauthorized commands have been executed.

Solution:
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules and add the following line:

-w &lt;Path to sudo logfile> -p wa -k actions

Example: vi /etc/audit/rules.d/actions.rules
and add the following line:

-w /var/log/sudo.log -p wa -k actions

Notes:

The system must be configured with su disabled (See Item 5.6 Ensure access to the su command is restricted) to force all command execution through sudo. This will not be effective on the console, as administrators can log in as root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|5.1,CSCv7|4.9,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>501b2b659bd8c6c0e4765b61086febd1e353604ec08dac2b9d5dd2b4066ee2f5</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.15 Ensure system administrator actions (sudolog) are collected - auditctl</cm:compliance-check-name>
        <cm:compliance-info>Monitor the sudo log file. If the system has been properly configured to disable the use of the su command and force all administrators to have to log in first and then use sudo to execute privileged commands, then all administrator commands will be logged to /var/log/sudo.log . Any time a command is executed, an audit event will be triggered as the /var/log/sudo.log file will be opened for write and the executed administration command will be written to the log.

Rationale:

Changes in /var/log/sudo.log indicate that an administrator has executed a command or the log file itself has been tampered with. Administrators will want to correlate the events written to the audit trail with the records written to /var/log/sudo.log to verify if unauthorized commands have been executed.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/var\/log\/sudo\.log[\s]+-p[\s]+wa[\s]+-k[\s]+actions$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|5.1, CSCv7|4.9, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules and add the following line:

-w &lt;Path to sudo logfile> -p wa -k actions

Example: vi /etc/audit/rules.d/actions.rules
and add the following line:

-w /var/log/sudo.log -p wa -k actions

Notes:

The system must be configured with su disabled (See Item 5.6 Ensure access to the su command is restricted) to force all command execution through sudo. This will not be effective on the console, as administrators can log in as root.

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - insmod" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b39bb1a24e89e67fdd9a1cc5bc903984ef011fcdcdf7aaf4aac97b6ae1cf5a56</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - insmod</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - auditctl insmod" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5f5dca23dc39b8f14aec44a2569c75add61c907fb3c78d179122a5afeedfe177</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - auditctl insmod</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/insmod[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - rmmod" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+/sbin/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/sbin/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/sbin/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+/sbin/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>68902d2f68c462e5f95fa1790fccfd1a3888d03b696d9da7eda317eead033d72</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - rmmod</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+/sbin/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+/sbin/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - auditctl rmmod" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>7275547d8a319270eb93eed611c7ac20adcd4beae74ed3fbeccee11b8e354547</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - auditctl rmmod</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/rmmod[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - modprobe" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>d8b698b73645dad96c72c6d08d8f28741d4e127ec85616670dbdf427facf3604</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - modprobe</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - auditctl modprobe" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>91e5bdbac3f50f475ad5a0baa06f7dc19e805a2291d09b0860012c09cff73367</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - auditctl modprobe</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-w[\s]+\/sbin\/modprobe[\s]+-p[\s]+x[\s]+-k[\s]+modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - init_module/delete_module (32-bit)" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>939c46efe9f7e1b91be256d2ec9212bf5153e5f7d865a97fe4b5e004f00e4bc7</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - init_module/delete_module (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - auditctl init_module/delete_module (32-bit)" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*init_module)(?=.*delete_module).*-F[\s]+key=modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*init_module)(?=.*delete_module).*-F[\s]+key=modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*init_module)(?=.*delete_module).*-F[\s]+key=modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>a3d53b1ab5b465ff86cc2932355cdc38a25da88f6f1864abff3097b68246ad6a</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - auditctl init_module/delete_module (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*init_module)(?=.*delete_module).*-F[\s]+key=modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - init_module/delete_module  (64-bit)" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$
system: Linux

Actual Value:
The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$"</description>
        <cm:compliance-actual-value>The file "/etc/audit/audit.rules" does not contain "^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>394a22f398ef95a2f0d84a72ba5d8addbb93d040f41c3f3f4e466fb90737b113</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - init_module/delete_module  (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$
file: /etc/audit/audit.rules
regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+init_module[\s]+-S[\s]+delete_module[\s]+-k[\s]+modules[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.16 Ensure kernel module loading and unloading is collected - auditctl init_module/delete_module (64-bit)" : [FAILED]

Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3,CSCv7|5.1,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*init_module)(?=.*delete_module).*-F[\s]+key=modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*init_module)(?=.*delete_module).*-F[\s]+key=modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*init_module)(?=.*delete_module).*-F[\s]+key=modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b9cb045ebb817de1c09597630d7436dfd8db88613f24cf5f90de25e345efbfe9</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.16 Ensure kernel module loading and unloading is collected - auditctl init_module/delete_module (64-bit)</cm:compliance-check-name>
        <cm:compliance-info>Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control loading and unloading of modules. The init_module (load a module) and delete_module (delete a module) system calls control loading and unloading of modules. Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of 'modules'.

Rationale:

Monitoring the use of insmod , rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+(?=.*init_module)(?=.*delete_module).*-F[\s]+key=modules$' | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|3, CSCv7|5.1, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S delete_module -k modules

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/modules.rules
and add the following lines:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.17 Ensure the audit configuration is immutable" : [FAILED]

Set system audit so that audit rules cannot be modified with auditctl . Setting the flag '-e 2' forces audit to be put in immutable mode. Audit changes can only be made on system reboot.

Rationale:

In immutable mode, unauthorized users cannot execute changes to the audit system to potentially hide malicious activity and then put the audit rules back. Users would most likely notice a system reboot and that could alert administrators of an attempt to make unauthorized audit changes.

Solution:
Edit or create the file /etc/audit/rules.d/99-finalize.rules and add the line

-e 2

at the end of the file

Notes:

This setting will ensure reloading the auditd config to set active settings requires a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CN-L3|8.1.10.6(d),CSCv6|3,CSCv7|6.2,CSCv7|6.3,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/grep -v "^$" /etc/audit/audit.rules | /usr/bin/tail -1
dont_echo_cmd: YES
expect: ^[\s]*-e[\s]+2[\s]*$
system: Linux

Actual Value:
The command returned : 

--backlog_wait_time 0</description>
        <cm:compliance-actual-value>The command returned : 

--backlog_wait_time 0</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>dd3e7f47c1e769675b99ac24944487dfa2923267866b81b24ad14f624a75dd1a</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.17 Ensure the audit configuration is immutable</cm:compliance-check-name>
        <cm:compliance-info>Set system audit so that audit rules cannot be modified with auditctl . Setting the flag '-e 2' forces audit to be put in immutable mode. Audit changes can only be made on system reboot.

Rationale:

In immutable mode, unauthorized users cannot execute changes to the audit system to potentially hide malicious activity and then put the audit rules back. Users would most likely notice a system reboot and that could alert administrators of an attempt to make unauthorized audit changes.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/grep -v "^$" /etc/audit/audit.rules | /usr/bin/tail -1
dont_echo_cmd: YES
expect: ^[\s]*-e[\s]+2[\s]*$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CN-L3|8.1.10.6(d), CSCv6|3, CSCv7|6.2, CSCv7|6.3, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2S, NESA|T3.2.1, PCI-DSSv3.1|2.2.4, PCI-DSSv3.2|2.2.4, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create the file /etc/audit/rules.d/99-finalize.rules and add the line

-e 2

at the end of the file

Notes:

This setting will ensure reloading the auditd config to set active settings requires a system reboot.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"5.2.6 Ensure SSH X11 forwarding is disabled" : [PASSED]

The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections.

Rationale:

Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders.

Solution:
Edit the /etc/ssh/sshd_config file to set the parameter as follows:

X11Forwarding no

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CIP|007-6-R1,CN-L3|8.1.10.6(d),CSCv7|9.2,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|1S,LEVEL|2S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3

Policy Value:
expect: ^[\s]*X11Forwarding[\s]+no[\s]*$
file: /etc/ssh/sshd_config
regex: ^[\s]*X11Forwarding[\s]
system: Linux

Actual Value:
Compliant file(s):
      /etc/ssh/sshd_config - regex '^[\s]*X11Forwarding[\s]' found - expect '^[\s]*X11Forwarding[\s]+no[\s]*$' found in the following lines:
          22: X11Forwarding no</description>
        <cm:compliance-actual-value>Compliant file(s):
      /etc/ssh/sshd_config - regex '^[\s]*X11Forwarding[\s]' found - expect '^[\s]*X11Forwarding[\s]+no[\s]*$' found in the following lines:
          22: X11Forwarding no</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>75a649a0fc1d66f4faf0b86fab5631c2df6ad6a53d0559d9adbab8611d8e03db</cm:compliance-check-id>
        <cm:compliance-check-name>5.2.6 Ensure SSH X11 forwarding is disabled</cm:compliance-check-name>
        <cm:compliance-info>The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections.

Rationale:

Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*X11Forwarding[\s]+no[\s]*$
file: /etc/ssh/sshd_config
regex: ^[\s]*X11Forwarding[\s]
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CIP|007-6-R1, CN-L3|8.1.10.6(d), CSCv7|9.2, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|1S, LEVEL|2S, NESA|T3.2.1, PCI-DSSv3.1|2.2.4, PCI-DSSv3.2|2.2.4, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit the /etc/ssh/sshd_config file to set the parameter as follows:

X11Forwarding no</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"5.2.21 Ensure SSH AllowTcpForwarding is disabled" : [PASSED]

SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. It can be used for adding encryption to legacy applications, going through firewalls, and some system administrators and IT professionals use it for opening backdoors into the internal network from their home machines

Rationale:

Leaving port forwarding enabled can expose the organization to security risks and back-doors.

SSH connections are protected with strong encryption. This makes their contents invisible to most deployed network monitoring and traffic filtering solutions. This invisibility carries considerable risk potential if it is used for malicious purposes such as data exfiltration. Cybercriminals or malware could exploit SSH to hide their unauthorized communications, or to exfiltrate stolen data from the target network

Solution:
Edit the /etc/ssh/sshd_config file to set the parameter as follows:

AllowTcpForwarding no

Impact:

SSH tunnels are widely used in many corporate environments that employ mainframe systems as their application backends. In those environments the applications themselves may have very limited native support for security. By utilizing tunneling, compliance with SOX, HIPAA, PCI-DSS, and other standards can be achieved without having to modify the applications.

Default Value:

AllowTcpForwarding yes

References:

https://www.ssh.com/ssh/tunneling/example

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CN-L3|8.1.10.6(d),CSCv7|9.2,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2S,NESA|T3.2.1,SWIFT-CSCv1|2.3

Policy Value:
expect: ^[\s]*AllowTcpForwarding[\s]+no[\s]*$
file: /etc/ssh/sshd_config
regex: ^[\s]*AllowTcpForwarding[\s]
system: Linux

Actual Value:
Compliant file(s):
      /etc/ssh/sshd_config - regex '^[\s]*AllowTcpForwarding[\s]' found - expect '^[\s]*AllowTcpForwarding[\s]+no[\s]*$' found in the following lines:
          63: AllowTcpForwarding no</description>
        <cm:compliance-actual-value>Compliant file(s):
      /etc/ssh/sshd_config - regex '^[\s]*AllowTcpForwarding[\s]' found - expect '^[\s]*AllowTcpForwarding[\s]+no[\s]*$' found in the following lines:
          63: AllowTcpForwarding no</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>0afee2ea9d92a9032de96dac0ac4841c2165281ba053b0b0f85d437aa76fd6ac</cm:compliance-check-id>
        <cm:compliance-check-name>5.2.21 Ensure SSH AllowTcpForwarding is disabled</cm:compliance-check-name>
        <cm:compliance-info>SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. It can be used for adding encryption to legacy applications, going through firewalls, and some system administrators and IT professionals use it for opening backdoors into the internal network from their home machines

Rationale:

Leaving port forwarding enabled can expose the organization to security risks and back-doors.

SSH connections are protected with strong encryption. This makes their contents invisible to most deployed network monitoring and traffic filtering solutions. This invisibility carries considerable risk potential if it is used for malicious purposes such as data exfiltration. Cybercriminals or malware could exploit SSH to hide their unauthorized communications, or to exfiltrate stolen data from the target network</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*AllowTcpForwarding[\s]+no[\s]*$
file: /etc/ssh/sshd_config
regex: ^[\s]*AllowTcpForwarding[\s]
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CN-L3|8.1.10.6(d), CSCv7|9.2, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2S, NESA|T3.2.1, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit the /etc/ssh/sshd_config file to set the parameter as follows:

AllowTcpForwarding no

Impact:

SSH tunnels are widely used in many corporate environments that employ mainframe systems as their application backends. In those environments the applications themselves may have very limited native support for security. By utilizing tunneling, compliance with SOX, HIPAA, PCI-DSS, and other standards can be achieved without having to modify the applications.

Default Value:

AllowTcpForwarding yes

References:

https://www.ssh.com/ssh/tunneling/example</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="2" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"6.1.1 Audit system file permissions" : [WARNING]

The Ubuntu package manager has a number of useful options. One of these, the --verify option, can be used to verify that system packages are correctly installed. The --verify option can be used to verify a particular package or to verify all system packages. If no output is returned, the package is installed correctly. The following table describes the meaning of output from the verify option:

Code   Meaning

S      File size differs.

M      File mode differs (includes permissions and file type).

5      The MD5 checksum differs.

D      The major and minor version numbers differ on a device file.

L      A mismatch occurs in a link.

U      The file ownership differs.

G      The file group owner differs.

T      The file time (mtime) differs.

The dpkg -S command can be used to determine which package a particular file belongs to. For example the following command determines which package the /bin/bash file belongs to:

# dpkg -S /bin/bash



bash: /bin/bash




To verify the settings for the package that controls the /bin/bash file, run the following:

# dpkg --verify bash



??5?????? c /etc/bash.bashrc

Rationale:

It is important to confirm that packaged system files and directories are maintained with the permissions they were intended to have from the OS vendor.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution:
Correct any discrepancies found and rerun the audit until output is clean or risk is mitigated or accepted.

Notes:

Since packages and important files may change with new updates and releases, it is recommended to verify everything, not just a finite list of files. This can be a time consuming task and results may depend on site policy therefore it is not a scorable benchmark item, but is provided for those interested in additional security measures.

Some of the recommendations of this benchmark alter the state of files audited by this recommendation. The audit command will alert for all changes to a file permissions even if the new state is more secure than the default.

See Also: https://workbench.cisecurity.org/files/2611

Reference: CSCv6|14.4,CSCv7|14.6,LEVEL|2NS

Policy Value:
WARNING</description>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>79108ca19f615ebba631613bd4f83427f83414add433dea43fd95a2221480e3d</cm:compliance-check-id>
        <cm:compliance-check-name>6.1.1 Audit system file permissions</cm:compliance-check-name>
        <cm:compliance-info>The Ubuntu package manager has a number of useful options. One of these, the --verify option, can be used to verify that system packages are correctly installed. The --verify option can be used to verify a particular package or to verify all system packages. If no output is returned, the package is installed correctly. The following table describes the meaning of output from the verify option:

Code   Meaning

S      File size differs.

M      File mode differs (includes permissions and file type).

5      The MD5 checksum differs.

D      The major and minor version numbers differ on a device file.

L      A mismatch occurs in a link.

U      The file ownership differs.

G      The file group owner differs.

T      The file time (mtime) differs.

The dpkg -S command can be used to determine which package a particular file belongs to. For example the following command determines which package the /bin/bash file belongs to:

# dpkg -S /bin/bash



bash: /bin/bash




To verify the settings for the package that controls the /bin/bash file, run the following:

# dpkg --verify bash



??5?????? c /etc/bash.bashrc

Rationale:

It is important to confirm that packaged system files and directories are maintained with the permissions they were intended to have from the OS vendor.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.</cm:compliance-info>
        <cm:compliance-policy-value>WARNING</cm:compliance-policy-value>
        <cm:compliance-reference>CSCv6|14.4, CSCv7|14.6, LEVEL|2NS</cm:compliance-reference>
        <cm:compliance-result>WARNING</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Correct any discrepancies found and rerun the audit until output is clean or risk is mitigated or accepted.

Notes:

Since packages and important files may change with new updates and releases, it is recommended to verify everything, not just a finite list of files. This can be a time consuming task and results may depend on site policy therefore it is not a scorable benchmark item, but is provided for those interested in additional security measures.

Some of the recommendations of this benchmark alter the state of files audited by this recommendation. The audit command will alert for all changes to a file permissions even if the new state is more secure than the default.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
    </ReportHost>
    <ReportHost name="ip-10-10-37-43">
      <HostProperties>
        <tag name="LastAuthenticatedResults">1616621314</tag>
        <tag name="host-fqdn">ip-10-10-37-43</tag>
        <tag name="host-ip">10.10.37.43</tag>
        <tag name="host-uuid">6098acbc-2cc3-42ef-8584-fa5bde9618bc</tag>
        <tag name="local-checks-proto">local</tag>
        <tag name="TAG">0b5e63e1ab9b4aa89ab53c15ec8fdfe6</tag>
        <tag name="HOST_START">Wed Mar 24 21:03:39 2021</tag>
        <tag name="HOST_END">Wed Mar 24 22:01:50 2021</tag>
        <tag name="os">other</tag>
        <tag name="policy-used">Policy Compliance Auditing</tag>
        <tag name="Credentialed_Scan">true</tag>
        <tag name="hostname">ip-10-10-37-43</tag>
      </HostProperties>
      <ReportItem severity="0" port="6062" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 6062/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="22" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 22/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="5432" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 5432/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="8126" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 8126/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="5000" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 5000/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="5001" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 5001/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="3000" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 3000/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="3001" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="tcp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 3001/tcp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="4500" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="udp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 4500/udp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="8125" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="udp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 8125/udp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="68" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="udp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 68/udp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="500" pluginFamily="Port scanners" pluginName="Netstat Portscanner (SSH)" pluginID="14272" protocol="udp" svc_name="unknown">
        <plugin_modification_date>2020/06/12</plugin_modification_date>
        <plugin_publication_date>2004/08/15</plugin_publication_date>
        <plugin_type>remote</plugin_type>
        <solution>n/a</solution>
        <description>Nessus was able to run 'netstat' on the remote host to enumerate the
open ports.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the 
event that the target being scanned is localhost.</description>
        <synopsis>Remote open ports can be enumerated via SSH.</synopsis>
        <see_also>https://en.wikipedia.org/wiki/Netstat</see_also>
        <risk_factor>None</risk_factor>
        <script_version>1.92</script_version>
        <plugin_output>Port 500/udp was found to be open</plugin_output>
      </ReportItem>
      <ReportItem severity="0" port="0" pluginFamily="Settings" pluginName="Nessus Scan Information" pluginID="19506" protocol="tcp" svc_name="general">
        <plugin_modification_date>2021/01/27</plugin_modification_date>
        <plugin_publication_date>2005/08/26</plugin_publication_date>
        <plugin_type>summary</plugin_type>
        <solution>n/a</solution>
        <description>This plugin displays, for each tested host, information about the
scan itself :

  - The version of the plugin set.
  - The type of scanner (Nessus or Nessus Home).
  - The version of the Nessus Engine.
  - The port scanner(s) used.
  - The port range scanned.
  - The ping round trip time 
  - Whether credentialed or third-party patch management
    checks are possible.
  - Whether the display of superseded patches is enabled
  - The date of the scan.
  - The duration of the scan.
  - The number of hosts scanned in parallel.
  - The number of checks done in parallel.</description>
        <synopsis>This plugin displays information about the Nessus scan.</synopsis>
        <risk_factor>None</risk_factor>
        <script_version>1.99</script_version>
        <plugin_output>Information about this scan : 

Nessus version : 8.2.2
Plugin feed version : 202103241357
Scanner edition used : Nessus
Scan type : Unix Agent
Scan policy used : Policy Compliance Auditing
Scanner IP : 127.0.0.1
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : yes (on the localhost)
Attempt Least Privilege : no
Patch management checks : None
Display superseded patches : yes (supersedence plugin did not launch)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 100
Max checks : 5
Recv timeout : 5
Backports : None
Allow post-scan editing: Yes
Scan Start Date : 2021/3/24 21:28 UTC
Scan duration : 15 sec
</plugin_output>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit from CIS Ubuntu Linux 18.04 LTS Benchmark" : [PASSED]

See Also: https://workbench.cisecurity.org/files/2611

Policy Value:
PASSED</description>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>a4a434a6fac51bca9617d1d9cf7276e2efe5afc1a85b890f908a2326aa53881b</cm:compliance-check-id>
        <cm:compliance-check-name>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit from CIS Ubuntu Linux 18.04 LTS Benchmark</cm:compliance-check-name>
        <cm:compliance-policy-value>PASSED</cm:compliance-policy-value>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.1.8 Ensure mounting of FAT filesystems is limited - fstab" : [PASSED]

The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2NS,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/grep -E -i '^[^#]*svfats' /etc/fstab | /usr/bin/awk '{print} END {if (NR == 0) print "none"}'
expect: ^none$
system: Linux

Actual Value:
The command '/bin/grep -E -i '^[^#]*svfats' /etc/fstab | /usr/bin/awk '{print} END {if (NR == 0) print "none"}'' returned : 

none</description>
        <cm:compliance-actual-value>The command '/bin/grep -E -i '^[^#]*svfats' /etc/fstab | /usr/bin/awk '{print} END {if (NR == 0) print "none"}'' returned : 

none</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1604fba75675449755beb16f0ad68142fd18767aa53eb0b79054310d61403fd7</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.1.8 Ensure mounting of FAT filesystems is limited - fstab</cm:compliance-check-name>
        <cm:compliance-info>The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/grep -E -i '^[^#]*svfats' /etc/fstab | /usr/bin/awk '{print} END {if (NR == 0) print "none"}'
expect: ^none$
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2NS, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="2" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.1.8 Ensure mounting of FAT filesystems is limited - modprobe" : [WARNING]

The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2NS,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v vfat
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v vfat' did not return any result</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v vfat' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>50e16f4155fa4945be02a15597a3046282783105815d9a45e62ec6ef7ad5069b</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.1.8 Ensure mounting of FAT filesystems is limited - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v vfat
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2NS, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>WARNING</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.1.8 Ensure mounting of FAT filesystems is limited - lsmod" : [PASSED]

The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2NS,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep vfat | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep vfat | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep vfat | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>76982007b1bb9bdc54d74d16d4cc1f6b819812398524502d589132bc6f0a348d</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.1.8 Ensure mounting of FAT filesystems is limited - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep vfat | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2NS, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/vfat.conf

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

The FAT filesystem format is used by UEFI systems for the EFI boot partition. Disabling the vfat module can prevent boot on UEFI systems.

FAT filesystems are often used on portable USB sticks and other flash media which are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.6 Ensure separate partition exists for /var" : [FAILED]

The /var directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world-writable.

Rationale:

Since the /var directory may contain world-writable files and directories, there is a risk of resource exhaustion if it is not bound to a separate partition.

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /var .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2S,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/var[\s]'
expect: on[\s]+/var[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/var[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/var[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5b46df3c9922510e376a57510888eecd49b19836c08b3aea191b7a3bb4fe107f</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.6 Ensure separate partition exists for /var</cm:compliance-check-name>
        <cm:compliance-info>The /var directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world-writable.

Rationale:

Since the /var directory may contain world-writable files and directories, there is a risk of resource exhaustion if it is not bound to a separate partition.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/var[\s]'
expect: on[\s]+/var[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2S, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /var .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.7 Ensure separate partition exists for /var/tmp" : [FAILED]

The /var/tmp directory is a world-writable directory used for temporary storage by all users and some applications.

Rationale:

Since the /var/tmp directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. In addition, making /var/tmp its own file system allows an administrator to set the noexec option on the mount, making /var/tmp useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /var/tmp .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2S,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/tmp[\s]'
expect: on[\s]+/var/tmp[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/var/tmp[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/var/tmp[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>416c014598552acbf45a74134514c13afd27758043e47a98e44eb9d515e652fb</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.7 Ensure separate partition exists for /var/tmp</cm:compliance-check-name>
        <cm:compliance-info>The /var/tmp directory is a world-writable directory used for temporary storage by all users and some applications.

Rationale:

Since the /var/tmp directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. In addition, making /var/tmp its own file system allows an administrator to set the noexec option on the mount, making /var/tmp useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/tmp[\s]'
expect: on[\s]+/var/tmp[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2S, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /var/tmp .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.11 Ensure separate partition exists for /var/log" : [FAILED]

The /var/log directory is used by system services to store log data .

Rationale:

There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data.

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /var/log .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var/log it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CN-L3|7.1.2.3(d),CN-L3|7.1.3.3(f),CSCv6|6.3,CSCv7|6.4,CSF|PR.IP-1,ISO/IEC-27001|A.12.4.2,ITSG-33|CM-6,LEVEL|2S,NESA|M5.2.3,NESA|M5.5.2,NESA|T3.2.1,NESA|T3.6.4,NESA|T8.2.9,NIAv2|SM5,NIAv2|SM6,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/log[\s]'
expect: on[\s]+/var/log[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/var/log[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/var/log[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>f600ba0773d6426c319aa28abaa2f97d703ab08f51407e0a794934c1b8e9d15b</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.11 Ensure separate partition exists for /var/log</cm:compliance-check-name>
        <cm:compliance-info>The /var/log directory is used by system services to store log data .

Rationale:

There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/log[\s]'
expect: on[\s]+/var/log[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CN-L3|7.1.2.3(d), CN-L3|7.1.3.3(f), CSCv6|6.3, CSCv7|6.4, CSF|PR.IP-1, ISO/IEC-27001|A.12.4.2, ITSG-33|CM-6, LEVEL|2S, NESA|M5.2.3, NESA|M5.5.2, NESA|T3.2.1, NESA|T3.6.4, NESA|T8.2.9, NIAv2|SM5, NIAv2|SM6, PCI-DSSv3.1|2.2.4, PCI-DSSv3.2|2.2.4, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /var/log .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var/log it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.12 Ensure separate partition exists for /var/log/audit" : [FAILED]

The auditing daemon, auditd , stores log data in the /var/log/audit directory.

Rationale:

There are two important reasons to ensure that data gathered by auditd is stored on a separate partition: protection against resource exhaustion (since the audit.log file can grow quite large) and protection of audit data. The audit daemon calculates how much free space is left and performs actions based on the results. If other processes (such as syslog ) consume space in the same partition as auditd , it may not perform as desired.

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /var/log/audit .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var/log/audit it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.8,800-171|3.4.2,800-53|AU-9,800-53|CM-6,CN-L3|7.1.2.3(d),CN-L3|7.1.3.3(f),CN-L3|8.1.10.6(d),CN-L3|8.1.3.5(c),CN-L3|8.1.4.3(c),CSCv6|6.3,CSCv7|6.4,CSF|PR.IP-1,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.2,ITSG-33|AU-9,ITSG-33|CM-6,LEVEL|2S,NESA|M5.2.3,NESA|M5.5.2,NESA|T3.2.1,NESA|T3.6.4,NESA|T8.2.9,NIAv2|SM5,NIAv2|SM6,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,QCSC-v1|13.2,QCSC-v1|8.2.1,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/log/audit[\s]'
expect: on[\s]+/var/log/audit[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/var/log/audit[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/var/log/audit[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1084bbdd84e5e61d6aba3f0a96dc841602c2c26378cdbbd2cbe1a93fb0038d8c</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.12 Ensure separate partition exists for /var/log/audit</cm:compliance-check-name>
        <cm:compliance-info>The auditing daemon, auditd , stores log data in the /var/log/audit directory.

Rationale:

There are two important reasons to ensure that data gathered by auditd is stored on a separate partition: protection against resource exhaustion (since the audit.log file can grow quite large) and protection of audit data. The audit daemon calculates how much free space is left and performs actions based on the results. If other processes (such as syslog ) consume space in the same partition as auditd , it may not perform as desired.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/var/log/audit[\s]'
expect: on[\s]+/var/log/audit[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.8, 800-171|3.4.2, 800-53|AU-9, 800-53|CM-6, CN-L3|7.1.2.3(d), CN-L3|7.1.3.3(f), CN-L3|8.1.10.6(d), CN-L3|8.1.3.5(c), CN-L3|8.1.4.3(c), CSCv6|6.3, CSCv7|6.4, CSF|PR.IP-1, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.2, ITSG-33|AU-9, ITSG-33|CM-6, LEVEL|2S, NESA|M5.2.3, NESA|M5.5.2, NESA|T3.2.1, NESA|T3.6.4, NESA|T8.2.9, NIAv2|SM5, NIAv2|SM6, PCI-DSSv3.1|2.2.4, PCI-DSSv3.2|2.2.4, QCSC-v1|13.2, QCSC-v1|8.2.1, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /var/log/audit .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

Notes:

When modifying /var/log/audit it is advisable to bring the system to emergency mode (so auditd is not running), rename the existing directory, mount the new file system, and migrate the data over before returning to multiuser mode.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.1.13 Ensure separate partition exists for /home" : [FAILED]

The /home directory is used to support disk storage needs of local users.

Rationale:

If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under /home .

Solution:
For new installations, during installation create a custom partition setup and specify a separate partition for /home .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.2,800-53|CM-6,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6,LEVEL|2S,SWIFT-CSCv1|2.3

Policy Value:
cmd: /bin/mount | /bin/grep -P 'on[\s]+/home[\s]'
expect: on[\s]+/home[\s]+
system: Linux

Actual Value:
The command '/bin/mount | /bin/grep -P 'on[\s]+/home[\s]'' did not return any result</description>
        <cm:compliance-actual-value>The command '/bin/mount | /bin/grep -P 'on[\s]+/home[\s]'' did not return any result</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>600dc1ad0b30f4abdd58c26d2277f795add102c69b0837c707632730e6428ec2</cm:compliance-check-id>
        <cm:compliance-check-name>1.1.13 Ensure separate partition exists for /home</cm:compliance-check-name>
        <cm:compliance-info>The /home directory is used to support disk storage needs of local users.

Rationale:

If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under /home .</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/mount | /bin/grep -P 'on[\s]+/home[\s]'
expect: on[\s]+/home[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.2, 800-53|CM-6, CSCv7|5.1, CSF|PR.IP-1, ITSG-33|CM-6, LEVEL|2S, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>For new installations, during installation create a custom partition setup and specify a separate partition for /home .
For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

References:

AJ Lewis, 'LVM HOWTO', http://tldp.org/HOWTO/LVM-HOWTO/</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.7.1.4 Ensure all AppArmor Profiles are enforcing - loaded" : [PASSED]

AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.

Solution:
Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.1.1,800-171|3.1.2,800-53|AC-3(3),CSCv6|14.4,CSCv7|14.6,CSF|PR.AC-4,CSF|PR.PT-3,ITSG-33|AC-3(3),LEVEL|2S,NESA|T5.5.4,NESA|T7.5.3,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|5.2.2

Policy Value:
cmd: /usr/sbin/apparmor_status
expect: ^[\s]*[1-9][0-9]*[\s]+profiles[\s]+are[\s]+loaded
system: Linux

Actual Value:
The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1244) 
   /usr/lib/ipsec/charon (1397) 
   /usr/sbin/clamd (1275) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1233) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1657) 
0 processes are unconfined but have a profile defined.</description>
        <cm:compliance-actual-value>The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1244) 
   /usr/lib/ipsec/charon (1397) 
   /usr/sbin/clamd (1275) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1233) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1657) 
0 processes are unconfined but have a profile defined.</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e0be84d79f9cf6937a0d67800e34390571a554557f5b84668874dabc7e706681</cm:compliance-check-id>
        <cm:compliance-check-name>1.7.1.4 Ensure all AppArmor Profiles are enforcing - loaded</cm:compliance-check-name>
        <cm:compliance-info>AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /usr/sbin/apparmor_status
expect: ^[\s]*[1-9][0-9]*[\s]+profiles[\s]+are[\s]+loaded
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.1.1, 800-171|3.1.2, 800-53|AC-3(3), CSCv6|14.4, CSCv7|14.6, CSF|PR.AC-4, CSF|PR.PT-3, ITSG-33|AC-3(3), LEVEL|2S, NESA|T5.5.4, NESA|T7.5.3, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|5.2.2</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.7.1.4 Ensure all AppArmor Profiles are enforcing - complain" : [FAILED]

AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.

Solution:
Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.1.1,800-171|3.1.2,800-53|AC-3(3),CSCv6|14.4,CSCv7|14.6,CSF|PR.AC-4,CSF|PR.PT-3,ITSG-33|AC-3(3),LEVEL|2S,NESA|T5.5.4,NESA|T7.5.3,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|5.2.2

Policy Value:
cmd: /usr/sbin/apparmor_status
expect: ^[\s]*0[\s]+profiles[\s]+are[\s]+in[\s]+complain[\s]+mode
system: Linux

Actual Value:
The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1244) 
   /usr/lib/ipsec/charon (1397) 
   /usr/sbin/clamd (1275) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1233) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1657) 
0 processes are unconfined but have a profile defined.</description>
        <cm:compliance-actual-value>The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1244) 
   /usr/lib/ipsec/charon (1397) 
   /usr/sbin/clamd (1275) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1233) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1657) 
0 processes are unconfined but have a profile defined.</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1670e10d1b4c61e042ee28544faf2e957074b5c8d24c6a9924d02a52d949650a</cm:compliance-check-id>
        <cm:compliance-check-name>1.7.1.4 Ensure all AppArmor Profiles are enforcing - complain</cm:compliance-check-name>
        <cm:compliance-info>AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /usr/sbin/apparmor_status
expect: ^[\s]*0[\s]+profiles[\s]+are[\s]+in[\s]+complain[\s]+mode
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.1.1, 800-171|3.1.2, 800-53|AC-3(3), CSCv6|14.4, CSCv7|14.6, CSF|PR.AC-4, CSF|PR.PT-3, ITSG-33|AC-3(3), LEVEL|2S, NESA|T5.5.4, NESA|T7.5.3, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|5.2.2</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"1.7.1.4 Ensure all AppArmor Profiles are enforcing - unconfined" : [PASSED]

AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.

Solution:
Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.1.1,800-171|3.1.2,800-53|AC-3(3),CSCv6|14.4,CSCv7|14.6,CSF|PR.AC-4,CSF|PR.PT-3,ITSG-33|AC-3(3),LEVEL|2S,NESA|T5.5.4,NESA|T7.5.3,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|5.2.2

Policy Value:
cmd: /usr/sbin/apparmor_status
expect: ^[\s]*0[\s]+processes[\s]+are[\s]+unconfined
system: Linux

Actual Value:
The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1244) 
   /usr/lib/ipsec/charon (1397) 
   /usr/sbin/clamd (1275) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1233) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1657) 
0 processes are unconfined but have a profile defined.</description>
        <cm:compliance-actual-value>The command '/usr/sbin/apparmor_status' returned : 

apparmor module is loaded.
28 profiles are loaded.
26 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/10908/usr/lib/snapd/snap-confine
   /snap/core/10908/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/core/9804/usr/lib/snapd/snap-confine
   /snap/core/9804/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/freshclam
   /usr/bin/lxc-start
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/ipsec/charon
   /usr/lib/ipsec/stroke
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/clamd
   /usr/sbin/tcpdump
   lxc-container-default
   lxc-container-default-cgns
   lxc-container-default-with-mounting
   lxc-container-default-with-nesting
   man_filter
   man_groff
   snap-update-ns.amazon-ssm-agent
   snap-update-ns.core
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
5 processes have profiles defined.
3 processes are in enforce mode.
   /usr/bin/freshclam (1244) 
   /usr/lib/ipsec/charon (1397) 
   /usr/sbin/clamd (1275) 
2 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (1233) 
   snap.amazon-ssm-agent.amazon-ssm-agent (1657) 
0 processes are unconfined but have a profile defined.</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>5a0a9394aa1194432b4689b2901733d9696fb84053104c512f292930ef53572a</cm:compliance-check-id>
        <cm:compliance-check-name>1.7.1.4 Ensure all AppArmor Profiles are enforcing - unconfined</cm:compliance-check-name>
        <cm:compliance-info>AppArmor profiles define what resources applications are able to access.

Rationale:

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /usr/sbin/apparmor_status
expect: ^[\s]*0[\s]+processes[\s]+are[\s]+unconfined
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.1.1, 800-171|3.1.2, 800-53|AC-3(3), CSCv6|14.4, CSCv7|14.6, CSF|PR.AC-4, CSF|PR.PT-3, ITSG-33|AC-3(3), LEVEL|2S, NESA|T5.5.4, NESA|T7.5.3, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|5.2.2</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to set all profiles to enforce mode:

# aa-enforce /etc/apparmor.d/*

Any unconfined processes may need to have a profile created or activated for them and then be restarted.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.1 Ensure DCCP is disabled - modprobe" : [FAILED]

The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

Rationale:

If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/dccp.conf
and add the following line:

install dccp /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CIP|007-6-R1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v dccp
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v dccp' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/dccp/dccp.ko</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v dccp' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/dccp/dccp.ko</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e037d1730fcc5a031e6de6a0d1f75ff49783b2de6cb6018827731a84a9c97ae2</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.1 Ensure DCCP is disabled - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

Rationale:

If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v dccp
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CIP|007-6-R1, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/dccp.conf
and add the following line:

install dccp /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.1 Ensure DCCP is disabled - lsmod" : [PASSED]

The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

Rationale:

If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/dccp.conf
and add the following line:

install dccp /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep dccp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep dccp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep dccp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>38e554ce49d5a8e7cd9c29c4015676f0daaff030139d1d6e278d089e83f14e9c</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.1 Ensure DCCP is disabled - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

Rationale:

If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep dccp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/dccp.conf
and add the following line:

install dccp /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.2 Ensure SCTP is disabled - modprobe" : [FAILED]

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/sctp.conf
and add the following line:

install sctp /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CIP|007-6-R1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v sctp
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v sctp' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/sctp/sctp.ko</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v sctp' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/sctp/sctp.ko</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>1d9c2eb6c7f711dc687ab63f8ea9aca6790f56362a092dc77656990bfec0f2a9</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.2 Ensure SCTP is disabled - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v sctp
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CIP|007-6-R1, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/sctp.conf
and add the following line:

install sctp /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.2 Ensure SCTP is disabled - lsmod" : [PASSED]

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/sctp.conf
and add the following line:

install sctp /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep sctp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep sctp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep sctp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>3328ad9e63c7fc3da06905f76d3c33e763e1fe9db4f63c4a09c8096bc0afe7d6</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.2 Ensure SCTP is disabled - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep sctp | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/sctp.conf
and add the following line:

install sctp /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.3 Ensure RDS is disabled - modprobe" : [FAILED]

The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/rds.conf
and add the following line:

install rds /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CIP|007-6-R1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v rds
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v rds' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/rds/rds.ko</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v rds' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/rds/rds.ko</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>99fd82e0888527989acb12eff6b6ece5bf7800172acd19f1ef243b0e03cb1f5b</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.3 Ensure RDS is disabled - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v rds
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CIP|007-6-R1, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/rds.conf
and add the following line:

install rds /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.3 Ensure RDS is disabled - lsmod" : [PASSED]

The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/rds.conf
and add the following line:

install rds /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep rds | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep rds | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep rds | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>d1a52cc395c78f5e8d7605583c4ac4d7a8e86607a8bff227041c7af748b55925</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.3 Ensure RDS is disabled - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep rds | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/rds.conf
and add the following line:

install rds /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.4 Ensure TIPC is disabled - modprobe" : [FAILED]

The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/tipc.conf
and add the following line:

install tipc /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CIP|007-6-R1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/modprobe -n -v tipc
expect: install /bin/true
system: Linux

Actual Value:
The command '/sbin/modprobe -n -v tipc' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/ipv4/udp_tunnel.ko 
insmod /lib/modules/4.15.0-1011-fips/kernel/net/ipv6/ip6_udp_tunnel.ko 
insmod /lib/modules/4.15.0-1011-fips/kernel/net/tipc/tipc.ko</description>
        <cm:compliance-actual-value>The command '/sbin/modprobe -n -v tipc' returned : 

insmod /lib/modules/4.15.0-1011-fips/kernel/net/ipv4/udp_tunnel.ko 
insmod /lib/modules/4.15.0-1011-fips/kernel/net/ipv6/ip6_udp_tunnel.ko 
insmod /lib/modules/4.15.0-1011-fips/kernel/net/tipc/tipc.ko</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>3db2caeceeda7a949bd56503baa0c7fe1febfb52b271a578e55a000b0de87a36</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.4 Ensure TIPC is disabled - modprobe</cm:compliance-check-name>
        <cm:compliance-info>The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/modprobe -n -v tipc
expect: install /bin/true
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CIP|007-6-R1, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/tipc.conf
and add the following line:

install tipc /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.4.4 Ensure TIPC is disabled - lsmod" : [PASSED]

The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.

Solution:
Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/tipc.conf
and add the following line:

install tipc /bin/true

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.6,800-171|3.4.7,800-53|CM-7,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7,LEVEL|2S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,NIAv2|SS15a,QCSC-v1|3.2,SWIFT-CSCv1|2.3

Policy Value:
cmd: /sbin/lsmod | /bin/grep tipc | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/lsmod | /bin/grep tipc | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</description>
        <cm:compliance-actual-value>The command '/sbin/lsmod | /bin/grep tipc | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'' returned : 

pass</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>b91d59e016faf4fa49bebb7013728be99e25efc8b40fed3656522e47b46fca39</cm:compliance-check-id>
        <cm:compliance-check-name>3.4.4 Ensure TIPC is disabled - lsmod</cm:compliance-check-name>
        <cm:compliance-info>The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Rationale:

If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /sbin/lsmod | /bin/grep tipc | /usr/bin/awk '{print} END {if (NR == 0) print "pass"; else print "fail"}'
expect: pass
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.6, 800-171|3.4.7, 800-53|CM-7, CN-L3|7.1.3.5(c), CN-L3|7.1.3.7(d), CN-L3|8.1.4.4(b), CSCv6|9.1, CSCv7|9.2, CSF|PR.IP-1, CSF|PR.PT-3, ITSG-33|CM-7, LEVEL|2S, NIAv2|SS13b, NIAv2|SS14a, NIAv2|SS14c, NIAv2|SS15a, QCSC-v1|3.2, SWIFT-CSCv1|2.3</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
Example: vi /etc/modprobe.d/tipc.conf
and add the following line:

install tipc /bin/true</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"3.7 Disable IPv6" : [FAILED]

Although IPv6 has many advantages over IPv4, not all organizations have IPv6 or dual stack configurations implemented.

Rationale:

If IPv6 or dual stack is not to be used, it is recommended that IPv6 be disabled to reduce the attack surface of the system.

Solution:
Edit /etc/default/grub and add ipv6.disable=1 to the GRUB_CMDLINE_LINUX parameters:

GRUB_CMDLINE_LINUX='ipv6.disable=1'

Run the following command to update the grub2 configuration:

# update-grub

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|SI-7(9),CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv6|11,CSCv6|3,CSCv6|9.1,CSCv7|9.4,CSF|PR.DS-6,LEVEL|2NS,QCSC-v1|3.2

Policy Value:
expect: ipv6\.disable[\s]*=[\s]*1
file: /etc/default/grub
regex: ^[\s]*GRUB_CMDLINE_LINUX[\s]*=[\s]*
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/default/grub - regex '^[\s]*GRUB_CMDLINE_LINUX[\s]*=[\s]*' found - expect 'ipv6\.disable[\s]*=[\s]*1' not found in the following lines:
          11: GRUB_CMDLINE_LINUX="audit=1"</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/default/grub - regex '^[\s]*GRUB_CMDLINE_LINUX[\s]*=[\s]*' found - expect 'ipv6\.disable[\s]*=[\s]*1' not found in the following lines:
          11: GRUB_CMDLINE_LINUX="audit=1"</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>dcc9e323d3118c8552c80fa72b9ec93ea2902b582d9f906453a093d36b90f2e4</cm:compliance-check-id>
        <cm:compliance-check-name>3.7 Disable IPv6</cm:compliance-check-name>
        <cm:compliance-info>Although IPv6 has many advantages over IPv4, not all organizations have IPv6 or dual stack configurations implemented.

Rationale:

If IPv6 or dual stack is not to be used, it is recommended that IPv6 be disabled to reduce the attack surface of the system.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ipv6\.disable[\s]*=[\s]*1
file: /etc/default/grub
regex: ^[\s]*GRUB_CMDLINE_LINUX[\s]*=[\s]*
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|SI-7(9), CN-L3|8.1.2.3, CN-L3|8.1.4.6, CSCv6|11, CSCv6|3, CSCv6|9.1, CSCv7|9.4, CSF|PR.DS-6, LEVEL|2NS, QCSC-v1|3.2</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit /etc/default/grub and add ipv6.disable=1 to the GRUB_CMDLINE_LINUX parameters:

GRUB_CMDLINE_LINUX='ipv6.disable=1'

Run the following command to update the grub2 configuration:

# update-grub</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.1.1 Ensure auditd is installed" : [FAILED]

auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution:
Run the following command to Install auditd

# apt install auditd audispd-plugins

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.4.8,800-53|CM-7(5),CSCv7|6.2,CSCv7|6.3,CSF|PR.IP-1,CSF|PR.PT-3,ISO/IEC-27001|A.12.5.1,ISO/IEC-27001|A.12.6.2,LEVEL|2S,PCI-DSSv3.1|12.3.7,PCI-DSSv3.2|12.3.7,SWIFT-CSCv1|2.3,TBA-FIISB|44.2.2,TBA-FIISB|49.2.3

Policy Value:
cmd: /usr/bin/dpkg -s audispd-plugins 2>&amp;1
expect: install[\s]+ok[\s]+installed
system: Linux

Actual Value:
The command '/usr/bin/dpkg -s audispd-plugins 2>&amp;1' returned : 

dpkg-query: package 'audispd-plugins' is not installed and no information is available
Use dpkg --info (= dpkg-deb --info) to examine archive files,
and dpkg --contents (= dpkg-deb --contents) to list their contents.</description>
        <cm:compliance-actual-value>The command '/usr/bin/dpkg -s audispd-plugins 2>&amp;1' returned : 

dpkg-query: package 'audispd-plugins' is not installed and no information is available
Use dpkg --info (= dpkg-deb --info) to examine archive files,
and dpkg --contents (= dpkg-deb --contents) to list their contents.</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>a3b73e25f8f83243c98dec8a14f08e61e6cde434944acc7df9334c5c10557b7e</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.1.1 Ensure auditd is installed</cm:compliance-check-name>
        <cm:compliance-info>auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /usr/bin/dpkg -s audispd-plugins 2>&amp;1
expect: install[\s]+ok[\s]+installed
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.4.8, 800-53|CM-7(5), CSCv7|6.2, CSCv7|6.3, CSF|PR.IP-1, CSF|PR.PT-3, ISO/IEC-27001|A.12.5.1, ISO/IEC-27001|A.12.6.2, LEVEL|2S, PCI-DSSv3.1|12.3.7, PCI-DSSv3.2|12.3.7, SWIFT-CSCv1|2.3, TBA-FIISB|44.2.2, TBA-FIISB|49.2.3</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to Install auditd

# apt install auditd audispd-plugins</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.1.2 Ensure auditd service is enabled" : [PASSED]

Enable and start the auditd daemon to record system events.

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution:
Run the following command to enable auditd :

# systemctl --now enable auditd

Notes:

Additional methods of enabling a service exist. Consult your distribution documentation for appropriate methods.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CIP|007-6-R1,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|6.2,CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /bin/systemctl is-enabled auditd | /usr/bin/awk '{print} END {if(NR==0) print "disabled" }'
dont_echo_cmd: YES
expect: enabled
system: Linux

Actual Value:
The command returned : 

enabled</description>
        <cm:compliance-actual-value>The command returned : 

enabled</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>ab5082f2a6664c330fafb8ccb5a6e113b3acedf28af7be360007128a4e2ee43c</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.1.2 Ensure auditd service is enabled</cm:compliance-check-name>
        <cm:compliance-info>Enable and start the auditd daemon to record system events.

Rationale:

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.</cm:compliance-info>
        <cm:compliance-policy-value>cmd: /bin/systemctl is-enabled auditd | /usr/bin/awk '{print} END {if(NR==0) print "disabled" }'
dont_echo_cmd: YES
expect: enabled
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.1, 800-171|3.3.2, 800-53|AU-12, CIP|007-6-R1, CN-L3|7.1.3.3(a), CN-L3|7.1.3.3(b), CN-L3|7.1.3.3(c), CN-L3|8.1.3.5(a), CN-L3|8.1.3.5(b), CN-L3|8.1.4.3(a), CSCv6|6.2, CSCv7|6.2, CSCv7|6.3, CSF|DE.CM-1, CSF|DE.CM-3, CSF|DE.CM-7, CSF|PR.PT-1, ISO/IEC-27001|A.12.4.1, ITSG-33|AU-12, LEVEL|2S, NESA|T3.6.2, NESA|T3.6.5, NESA|T3.6.6, NIAv2|SM8, PCI-DSSv3.1|2.2.2, PCI-DSSv3.1|2.2.3, PCI-DSSv3.2|2.2.2, PCI-DSSv3.2|2.2.3, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|6.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4, TBA-FIISB|45.1.1</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Run the following command to enable auditd :

# systemctl --now enable auditd

Notes:

Additional methods of enabling a service exist. Consult your distribution documentation for appropriate methods.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled" : [PASSED]

Configure grub so that processes that are capable of being audited can be audited even if they start up prior to auditd startup.

Rationale:

Audit events need to be captured on processes that start up prior to auditd , so that potential malicious activity cannot go undetected.

Solution:
Edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX:

GRUB_CMDLINE_LINUX='audit=1'

Run the following command to update the grub2 configuration:

# update-grub

Notes:

This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.

Replace /boot/grub/grub.cfg with the appropriate grub configuration file for your environment.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-14(1),800-53|SI-7(9),CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv6|6.2,CSCv7|6.2,CSCv7|6.3,CSF|PR.DS-6,CSF|PR.PT-1,LEVEL|2S,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4

Policy Value:
expect: ^[\s]*linux[\s]+.*audit=1.*[\s]*$
file: /boot/grub/grub.cfg
regex: ^[\s]*linux[\s]+
system: Linux

Actual Value:
Compliant file(s):
      /boot/grub/grub.cfg - regex '^[\s]*linux[\s]+' found - expect '^[\s]*linux[\s]+.*audit=1.*[\s]*$' found in the following lines:
          123:         linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          141: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          158: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1
          176: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          193: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1</description>
        <cm:compliance-actual-value>Compliant file(s):
      /boot/grub/grub.cfg - regex '^[\s]*linux[\s]+' found - expect '^[\s]*linux[\s]+.*audit=1.*[\s]*$' found in the following lines:
          123:         linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          141: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          158: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1
          176: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          193: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>beb3e9a25319309353b7d2126839697cb26ef1a207d7b42173b5a7d4768146d7</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled</cm:compliance-check-name>
        <cm:compliance-info>Configure grub so that processes that are capable of being audited can be audited even if they start up prior to auditd startup.

Rationale:

Audit events need to be captured on processes that start up prior to auditd , so that potential malicious activity cannot go undetected.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*linux[\s]+.*audit=1.*[\s]*$
file: /boot/grub/grub.cfg
regex: ^[\s]*linux[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-14(1), 800-53|SI-7(9), CN-L3|8.1.2.3, CN-L3|8.1.4.6, CSCv6|6.2, CSCv7|6.2, CSCv7|6.3, CSF|PR.DS-6, CSF|PR.PT-1, LEVEL|2S, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX:

GRUB_CMDLINE_LINUX='audit=1'

Run the following command to update the grub2 configuration:

# update-grub

Notes:

This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.

Replace /boot/grub/grub.cfg with the appropriate grub configuration file for your environment.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.1.4 Ensure audit_backlog_limit is sufficient" : [FAILED]

The backlog limit has a default setting of 64

Rationale:

during boot if audit=1, then the backlog will hold 64 records. If more that 64 records are created during boot, auditd records will be lost and potential malicious activity could go undetected.

Solution:
Edit /etc/default/grub and add audit_backlog_limit=&lt;BACKLOG SIZE> to GRUB_CMDLINE_LINUX:
Example:

GRUB_CMDLINE_LINUX='audit_backlog_limit=8192'

Run the following command to update the grub2 configuration:

# update-grub

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-14(1),800-53|SI-7(9),CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv7|6.2,CSCv7|6.3,CSF|PR.DS-6,CSF|PR.PT-1,LEVEL|2S,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4

Policy Value:
expect: ^[\s]*linux[\s]+.*audit_backlog_limit=(819[2-9]|8[2-9][0-9]{2}|9[0-9]{3}|[1-9][0-9]{4,}).*[\s]*$
file: /boot/grub/grub.cfg
regex: ^[\s]*linux[\s]+
system: Linux

Actual Value:
Non-compliant file(s):
      /boot/grub/grub.cfg - regex '^[\s]*linux[\s]+' found - expect '^[\s]*linux[\s]+.*audit_backlog_limit=(819[2-9]|8[2-9][0-9]{2}|9[0-9]{3}|[1-9][0-9]{4,}).*[\s]*$' not found in the following lines:
          123:         linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          141: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          158: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1
          176: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          193: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /boot/grub/grub.cfg - regex '^[\s]*linux[\s]+' found - expect '^[\s]*linux[\s]+.*audit_backlog_limit=(819[2-9]|8[2-9][0-9]{2}|9[0-9]{3}|[1-9][0-9]{4,}).*[\s]*$' not found in the following lines:
          123:         linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          141: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          158: 	        linux	/boot/vmlinuz-4.15.0-1011-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1
          176: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro audit=1 console=tty1 console=ttyS0 nvme_core.io_timeout=4294967295 fips=1 fips=1
          193: 	        linux	/boot/vmlinuz-4.15.0-2000-aws-fips root=UUID=90e1dfca-b055-4f93-b62e-6347bcb451a7 ro recovery nomodeset dis_ucode_ldr audit=1</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>0d5a1c8227f347c747dd36d194b25c1c2189dfffc21c8c9bd70fe6233ae8a37b</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.1.4 Ensure audit_backlog_limit is sufficient</cm:compliance-check-name>
        <cm:compliance-info>The backlog limit has a default setting of 64

Rationale:

during boot if audit=1, then the backlog will hold 64 records. If more that 64 records are created during boot, auditd records will be lost and potential malicious activity could go undetected.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*linux[\s]+.*audit_backlog_limit=(819[2-9]|8[2-9][0-9]{2}|9[0-9]{3}|[1-9][0-9]{4,}).*[\s]*$
file: /boot/grub/grub.cfg
regex: ^[\s]*linux[\s]+
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-14(1), 800-53|SI-7(9), CN-L3|8.1.2.3, CN-L3|8.1.4.6, CSCv7|6.2, CSCv7|6.3, CSF|PR.DS-6, CSF|PR.PT-1, LEVEL|2S, QCSC-v1|13.2, QCSC-v1|3.2, QCSC-v1|8.2.1, SWIFT-CSCv1|6.4</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Edit /etc/default/grub and add audit_backlog_limit=&lt;BACKLOG SIZE> to GRUB_CMDLINE_LINUX:
Example:

GRUB_CMDLINE_LINUX='audit_backlog_limit=8192'

Run the following command to update the grub2 configuration:

# update-grub</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.1 Ensure audit log storage size is configured" : [FAILED]

Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started.

Rationale:

It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost.

Solution:
Set the following parameter in /etc/audit/auditd.conf in accordance with site policy:

max_log_file = &lt;MB>

Notes:

The max_log_file parameter is measured in megabytes.

Other methods of log rotation may be appropriate based on site policy. One example is time-based rotation strategies which don't have native support in auditd configurations. Manual audit of custom configurations should be evaluated for effectiveness and completeness.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-4,CSCv6|6.3,CSCv7|6.4,CSF|PR.DS-4,CSF|PR.PT-1,ITSG-33|AU-4,LEVEL|2S,NESA|T3.3.1,NESA|T3.6.2

Policy Value:
expect: ^[\s]*max_log_file[\s]*=[\s]*32[\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*max_log_file[\s]*=
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*max_log_file[\s]*=' found - expect '^[\s]*max_log_file[\s]*=[\s]*32[\s]*$' not found in the following lines:
          12: max_log_file = 8</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*max_log_file[\s]*=' found - expect '^[\s]*max_log_file[\s]*=[\s]*32[\s]*$' not found in the following lines:
          12: max_log_file = 8</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>e500cc8a802bc7694994e6db78f18b034e1d28782eb4a6912325b339240c22ed</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.1 Ensure audit log storage size is configured</cm:compliance-check-name>
        <cm:compliance-info>Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started.

Rationale:

It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*max_log_file[\s]*=[\s]*32[\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*max_log_file[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-4, CSCv6|6.3, CSCv7|6.4, CSF|PR.DS-4, CSF|PR.PT-1, ITSG-33|AU-4, LEVEL|2S, NESA|T3.3.1, NESA|T3.6.2</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameter in /etc/audit/auditd.conf in accordance with site policy:

max_log_file = &lt;MB>

Notes:

The max_log_file parameter is measured in megabytes.

Other methods of log rotation may be appropriate based on site policy. One example is time-based rotation strategies which don't have native support in auditd configurations. Manual audit of custom configurations should be evaluated for effectiveness and completeness.</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.2 Ensure audit logs are not automatically deleted" : [FAILED]

The max_log_file_action setting determines how to handle the audit log file reaching the max file size. A value of keep_logs will rotate the logs but never delete old logs.

Rationale:

In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history.

Solution:
Set the following parameter in /etc/audit/auditd.conf:

max_log_file_action = keep_logs

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.4,800-53|AU-5,CN-L3|7.1.3.3(e),CSCv6|6.3,CSCv7|6.4,CSF|PR.PT-1,ITSG-33|AU-5,LEVEL|2S,NESA|T3.6.2,QCSC-v1|13.2,QCSC-v1|8.2.1

Policy Value:
expect: ^[\s]*max_log_file_action[\s]*=[\s]*[Kk][Ee][Ee][Pp]_[Ll][Oo][Gg][Ss][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*max_log_file_action[\s]*=
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*max_log_file_action[\s]*=' found - expect '^[\s]*max_log_file_action[\s]*=[\s]*[Kk][Ee][Ee][Pp]_[Ll][Oo][Gg][Ss][\s]*$' not found in the following lines:
          19: max_log_file_action = ROTATE</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*max_log_file_action[\s]*=' found - expect '^[\s]*max_log_file_action[\s]*=[\s]*[Kk][Ee][Ee][Pp]_[Ll][Oo][Gg][Ss][\s]*$' not found in the following lines:
          19: max_log_file_action = ROTATE</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>6e13000c5b809d2c8fc00608ff7cd19e333e485822287be53c2e4f2c542242dd</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.2 Ensure audit logs are not automatically deleted</cm:compliance-check-name>
        <cm:compliance-info>The max_log_file_action setting determines how to handle the audit log file reaching the max file size. A value of keep_logs will rotate the logs but never delete old logs.

Rationale:

In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*max_log_file_action[\s]*=[\s]*[Kk][Ee][Ee][Pp]_[Ll][Oo][Gg][Ss][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*max_log_file_action[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.4, 800-53|AU-5, CN-L3|7.1.3.3(e), CSCv6|6.3, CSCv7|6.4, CSF|PR.PT-1, ITSG-33|AU-5, LEVEL|2S, NESA|T3.6.2, QCSC-v1|13.2, QCSC-v1|8.2.1</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameter in /etc/audit/auditd.conf:

max_log_file_action = keep_logs</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.3 Ensure system is disabled when audit logs are full - 'space_left_action = email'" : [FAILED]

The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution:
Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-5,CSCv6|6.3,CSCv7|6.4,CSF|PR.PT-1,ITSG-33|AU-5,LEVEL|2S,NIAv2|GS7f

Policy Value:
expect: ^[\s]*space_left_action[\s]*=[\s]*[Ee][Mm][Aa][Ii][Ll][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*space_left_action[\s]*=
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*space_left_action[\s]*=' found - expect '^[\s]*space_left_action[\s]*=[\s]*[Ee][Mm][Aa][Ii][Ll][\s]*$' not found in the following lines:
          21: space_left_action = SYSLOG</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*space_left_action[\s]*=' found - expect '^[\s]*space_left_action[\s]*=[\s]*[Ee][Mm][Aa][Ii][Ll][\s]*$' not found in the following lines:
          21: space_left_action = SYSLOG</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>851345a359be44bc57399f60628166b6e59dfdc9952d2be7edc6f30baf14f745</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.3 Ensure system is disabled when audit logs are full - 'space_left_action = email'</cm:compliance-check-name>
        <cm:compliance-info>The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*space_left_action[\s]*=[\s]*[Ee][Mm][Aa][Ii][Ll][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*space_left_action[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-5, CSCv6|6.3, CSCv7|6.4, CSF|PR.PT-1, ITSG-33|AU-5, LEVEL|2S, NIAv2|GS7f</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="1" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.3 Ensure system is disabled when audit logs are full - 'action_mail_acct = root'" : [PASSED]

The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution:
Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.4,800-53|AU-5,CN-L3|7.1.3.3(e),CSCv6|6.3,CSCv7|6.4,CSF|PR.PT-1,ITSG-33|AU-5,LEVEL|2S,NESA|T3.6.2,QCSC-v1|13.2,QCSC-v1|8.2.1

Policy Value:
expect: ^[\s]*action_mail_acct[\s]*=[\s]*root[\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*action_mail_acct[\s]*=
system: Linux

Actual Value:
Compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*action_mail_acct[\s]*=' found - expect '^[\s]*action_mail_acct[\s]*=[\s]*root[\s]*$' found in the following lines:
          23: action_mail_acct = root</description>
        <cm:compliance-actual-value>Compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*action_mail_acct[\s]*=' found - expect '^[\s]*action_mail_acct[\s]*=[\s]*root[\s]*$' found in the following lines:
          23: action_mail_acct = root</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>87a5019362188f880b12b0db9f7a6722c0d770cc81e56dc2ad0431e391a8028a</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.3 Ensure system is disabled when audit logs are full - 'action_mail_acct = root'</cm:compliance-check-name>
        <cm:compliance-info>The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*action_mail_acct[\s]*=[\s]*root[\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*action_mail_acct[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-171|3.3.4, 800-53|AU-5, CN-L3|7.1.3.3(e), CSCv6|6.3, CSCv7|6.4, CSF|PR.PT-1, ITSG-33|AU-5, LEVEL|2S, NESA|T3.6.2, QCSC-v1|13.2, QCSC-v1|8.2.1</cm:compliance-reference>
        <cm:compliance-result>PASSED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.2.3 Ensure system is disabled when audit logs are full - 'admin_space_left_action = halt'" : [FAILED]

The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Solution:
Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-53|AU-5,CSCv6|6.3,CSCv7|6.4,CSF|PR.PT-1,ITSG-33|AU-5,LEVEL|2S

Policy Value:
expect: ^[\s]*admin_space_left_action[\s]*=[\s]*[Hh][Aa][Ll][Tt][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*admin_space_left_action[\s]*=
system: Linux

Actual Value:
Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*admin_space_left_action[\s]*=' found - expect '^[\s]*admin_space_left_action[\s]*=[\s]*[Hh][Aa][Ll][Tt][\s]*$' not found in the following lines:
          25: admin_space_left_action = SUSPEND</description>
        <cm:compliance-actual-value>Non-compliant file(s):
      /etc/audit/auditd.conf - regex '^[\s]*admin_space_left_action[\s]*=' found - expect '^[\s]*admin_space_left_action[\s]*=[\s]*[Hh][Aa][Ll][Tt][\s]*$' not found in the following lines:
          25: admin_space_left_action = SUSPEND</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>2d0bf429882a38e136552f24adebfb06fbd0317cc794eed6270bd199397c7ad6</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.2.3 Ensure system is disabled when audit logs are full - 'admin_space_left_action = halt'</cm:compliance-check-name>
        <cm:compliance-info>The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale:

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.</cm:compliance-info>
        <cm:compliance-policy-value>expect: ^[\s]*admin_space_left_action[\s]*=[\s]*[Hh][Aa][Ll][Tt][\s]*$
file: /etc/audit/auditd.conf
regex: ^[\s]*admin_space_left_action[\s]*=
system: Linux</cm:compliance-policy-value>
        <cm:compliance-reference>800-53|AU-5, CSCv6|6.3, CSCv7|6.4, CSF|PR.PT-1, ITSG-33|AU-5, LEVEL|2S</cm:compliance-reference>
        <cm:compliance-result>FAILED</cm:compliance-result>
        <cm:compliance-see-also>https://workbench.cisecurity.org/files/2611</cm:compliance-see-also>
        <cm:compliance-solution>Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt</cm:compliance-solution>
        <script_version>$Revision: 1.480 $</script_version>
      </ReportItem>
      <ReportItem severity="3" port="0" pluginFamily="Policy Compliance" pluginName="Unix Compliance Checks" pluginID="21157" protocol="" svc_name="unknown">
        <description>"4.1.3 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)" : [FAILED]

Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seconds since 1/1/1970) or clock_settime (allows for the setting of several internal clocks and timers) system calls have been executed and always write an audit record to the /var/log/audit.log file upon exit, tagging the records with the identifier 'time-change'

Rationale:

Unexpected changes in system date and/or time could be a sign of malicious activity on the system.

Solution:
For 32 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

For 64 bit systems Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules
Example: vi /etc/audit/rules.d/time-change.rules
and add the following lines:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

Notes:

Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

See Also: https://workbench.cisecurity.org/files/2611

Reference: 800-171|3.3.1,800-171|3.3.2,800-53|AU-12,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv6|3.6,CSCv7|5.5,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12,LEVEL|2S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|13.2,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1

Policy Value:
cmd: /sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'
expect: pass
system: Linux

Actual Value:
The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</description>
        <cm:compliance-actual-value>The command '/sbin/auditctl -l | /bin/grep -P '^-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+(?=.*adjtimex)(?=.*settimeofday).*-F[\s]+key=time-change$'  | /usr/bin/awk '{print} END {if (NR != 0) print "pass" ; else print "fail"}'' returned : 

fail</cm:compliance-actual-value>
        <cm:compliance-audit-file>CIS_Ubuntu_18.04_LTS_Server_v2.0.1_L2.audit</cm:compliance-audit-file>
        <cm:compliance-check-id>a8b2f2261eb3b7b4d80071498b7d58f37db532a39c36d5524012ce0d209aacb7</cm:compliance-check-id>
        <cm:compliance-check-name>4.1.3 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)</cm:compliance-check-name>
        <cm:compliance-info>Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtim