>From 9e76f9b8a270972d7ff2523b34d5e0246d7a59a7 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 21 Feb 2012 20:19:45 -0500 Subject: [PATCH] 22-FEB-2012 shawn@redhat.com - Updated rhel6/src/input/system/auditing.xml to include additional DCID 6/3 and ICD checks --- rhel6/src/input/system/auditing.xml | 231 ++++++++++++++++++++++++++--------- 1 files changed, 175 insertions(+), 56 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 628be6a..7c37ac6 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -1,32 +1,19 @@ -System Accounting with <tt>auditd</tt> -The audit service provides substantial capabilities -for recording system activities. -By default, the service audits about -SELinux AVC denials and certain types of security-relevant events -such as system logins, account modifications, and authentication -events performed by programs such as sudo. -

-Under its default configuration, auditd has modest disk space -requirements, and should not noticeably impact system performance. -The audit service, in its default configuration, is strongly -recommended for all sites, regardless of whether they are running -SELinux. -

-Government networks often have substantial auditing -requirements and auditd can be configured to meet these -requirements. -

-Example requirements include: -

-
    -
  • Ensure Auditing is Configured to Collect Certain System Events + System Accounting with <tt>auditd</tt> + +

    The audit service provides substantial capabilities for recording system activities. By default the service audits about SELinux AVC denials and certain types of security-relevant events such as system logins, account modifications, and authentication events performed by programs such as sudo.

    + +

    Under its default configuration auditd has modest disk space requirements and should not noticeably impact system performance. The audit service, in its default configuration, is strongly recommended for all sites, regardless of whether they are running SELinux.

    + +

    Government networks often have substantial auditing requirements and auditd can be configured to meet these requirements. Example requirements include:

      -
    • Information on the Use of Print Command (unsuccessful and successful)
    • -
    • Startup and Shutdown Events (unsuccessful and successful)
    • -
  • -
  • Ensure the auditing software can record the following for each -audit event: +
  • Ensure Auditing is Configured to Collect Certain System Events +
      +
    • Information on the Use of Print Command (unsuccessful and successful)
    • +
    • Startup and Shutdown Events (unsuccessful and successful)
    • +
    +
  • +
  • Ensure the auditing software can record the following for each audit event:
    • Date and time of the event
    • Userid that initiated the event
    • @@ -66,12 +53,12 @@ data if the system is busy. Enable auditd Service -Ensure that the auditd service is enabled (this is the -default): -
      -
      -# chkconfig auditd on
      -
      + +Ensure that the auditd service is enabled (Note: auditd is enabled by default in all Red Hat Enterprise Linux 6 installations): +
      +
      +  # chkconfig auditd on
      +  
      @@ -80,6 +67,34 @@ default):
      + +Enable Auditing of Attempts to Access Audit Data +Successful and unsuccessful attempts to read information from system audit records, including any manual modifications, should be audited. The following should be added to the /etc/audit/audit.rules file: +
      +
      -w /var/log/audit -k audit_data_access_attempts
      +
      + + + + +
      + + +Enable Auditing of <tt>auditd</tt> Collection Functions +Modifications to the audit configuration that occur while the audit collection functions are operationg should be monitored. This can be enabled by including the following lines in /etc/audit/audit.rules: +
      +
      +-w /etc/audit -p wa -k audit_daemon_modifications
      +-w /etc/sysconfig/auditd -p wa -k audit_daemon_modifications
      +-w /etc/libaudit.conf -p wa -k audit_daemon_modifications
      +-w /etc/audisp/ -p wa -k audit_daemon_modifications
      +
      + + + + +
      + Enable Auditing for Processes Which Start Prior to the Audit Daemon To ensure that all processes can be audited, even @@ -147,23 +162,113 @@ editing as needed, activate the new rules: Records Events that Modify Date and Time Information -Add the following to /etc/audit/audit.rules, setting -ARCH to either b32 or b64 as appropriate for your system: +Add the following to /etc/audit/audit.rules. Note that both the arch=b32 and arch=b64 audit rules should be in place to account for both the 32 and 64 bit system calls, regardless of underlying hardware architecture.
      --a always,exit -F arch=ARCH -S adjtimex -S settimeofday -S stime -k time-change
      --a always,exit -F arch=ARCH -S clock_settime -k time-change
      +-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
      +-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k time-change
       -w /etc/localtime -p wa -k time-change
      Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent -upon an accurate system time. All changes to the system time should be audited. +upon an accurate system time (for example, sshd). All changes to the system time should be audited.
      + + Audit umask Changes + Add the following to /etc/audit/audit.rules to the change of umask from the command line +
      +
      +-a always,exit -F arch=b32 -S umask
      +-a always,exit -F arch=b64 -S umask
      +
      + The umask command modifies the default setting of permissive or restrictive DAC rules. As such, alterations from the default umask should be audited + + + +
      + + + Audit Encrypted Channels + Add the following to /etc/audit/audit.rules audit the creation of trusted communication channels +
      +
      +-w /usr/sbin/stunnel -p x
      +-w /etc/stunnel/stunnel.conf -k audit_encrypted_channels
      +-w /etc/stunnel/stunnel.pem -k audit_encrypted_channels
      +
      +
      + The creation of encrypted communication channels should be audited, as they could be an indication of covert communications + + + +
      + + +Audit PAM Configuration +Add the following to /etc/audit/audit.rules to audit PAM configuration changes: +
      +
      +-w /etc/pam.d/ -p wa -k audit_pam_configuration
      +-w /etc/security/access.conf -p wa -k audit_pam_configuration
      +-w /etc/security/limits.conf -p wa -k audit_pam_configuration
      +-w /etc/security/pam_env.conf -p wa -k audit_pam_configuration
      +-w /etc/security/namespace.conf -p wa -k audit_pam_configuration
      +-w /etc/security/namespace.d/ -p wa -k audit_pam_configuration
      +-w /etc/security/namespace.init -p wa -k audit_pam_configuration
      +-w /etc/security/sepermit.conf -p wa -k audit_pam_configuration
      +-w /etc/security/time.conf -p wa -k audit_pam_configuation
      +PAM is the underlying mechanism for access authorizations on a Red Hat Enterprise Linux system. As such configuration changes to the PAM system should be monitored
      +
      +
      +
      +
      +
      +
      +Audit <tt>crond</tt> Configuration
      +<description>Add the following to <tt>/etc/audit/audit.rules</tt> to audit the <tt>crond</tt> configuration and scheduled jobs
      +<br />
      +<pre>
      +-w /etc/cron.allow -p wa -k audit_cron_configuration
      +-w /etc/cron.deny -p wa -k audit_cron_configuration
      +-w /etc/cron.d/ -p wa -k audit_cron_configuration
      +-w /etc/cron.daily/ -p wa -k audit_cron_configuration
      +-w /etc/cron.hourly/ -p wa -k audit_cron_configuration
      +-w /etc/cron.monthly/ -p wa -k audit_cron_configuration
      +-w /etc/crontab -p wa -k audit_cron_configuration
      +-w /var/spool/cron/root -k audit_cron_configuration</pre>
      +<rationale></rationale>
      +<ident cce="TBD" />
      +<oval id="audit_cron_configuration">
      +<ref nist="TBD" />
      +</Rule>
      +
      +<Rule id="audit_security_bindings">
      +<title>Audit User Security Attribute Binding Attempts
      +To audit the success and failure of binding user security attributes to a subject, add the following to /etc/audit/audit.rules:
      +
      +
      +-a always,exit -F arch=b32 -S clone
      +-a always,exit -F arch=b64 -S clone
      +-a always,exit -F arch=b32 -S fork -S vfork
      +-a always,exit -F arch=b64 -S fork -S vfork
      +
      +## FOR ia64 ARCHITECTURE: DISABLE THE fork AND vfork RULES ABOVE, AND
      +## ENABLE THE FOLLOWING:
      +#-a always,exit -S clone32
      + + + + +
      + + + + Record Events that Modify User/Group Information Add the following to /etc/audit/audit.rules, in order @@ -183,6 +288,22 @@ users or groups should be investigated. + +Audit Login Configuration and Information +To audit login configuration and information, add the following to /etc/audit/audit.rules: +
      +
      +-w /etc/login.defs -p wa -k audit_login_configuration
      +-w /etc/securetty -p wa -k audit_login_configuration
      +-w /var/run/faillock -p wa -k audit_login_configuration
      +-w /var/log/lastlog -p wa -k audit_login_configuration
      +-w /var/log/tallylog -p wa -k audit_login_configuration
      +
      + + + + +
      Record Events that Modify the System’s Network Environment @@ -195,6 +316,7 @@ ARCH to either b32 or b64 as appropriate for your system: -w /etc/issue.net -p wa -k system-locale -w /etc/hosts -p wa -k system-locale -w /etc/sysconfig/network -p wa -k system-locale +-w /etc/sysconfig/network-scripts -p wa -k system-locale
      The network environment should not be modified by anything other than @@ -223,26 +345,23 @@ anything other than administrator action. All changes to MAC policy should be au -Ensure <tt>auditd</tt> Collects Discretionary Access Control -Permission Modification Events -At a minimum the audit system should collect file -permission changes for all users and root. Add the following to -/etc/audit/audit.rules, setting ARCH to either b32 or b64 as -appropriate for your system: +Ensure <tt>auditd</tt> Collects Discretionary Access Control Permission Modification Events +At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:
      --a always,exit -F arch=ARCH -S chmod -S fchmod -S fchmodat \
      -    -F auid>=500 -F auid!=4294967295 -k perm_mod
      --a always,exit -F arch=ARCH -S chown -S fchown -S fchownat \ 
      -    -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
      --a always,exit -F arch=ARCH -S setxattr -S lsetxattr \
      -    -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \
      -    -F auid>=500 -F auid!=4294967295 -k perm_mod
      +-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat +-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat +-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown +-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown + +## ENABLE THE FOLLOWING RULE ONLY IF ON i386 OR s390 +## DO NOT USE FOR x86_64, ia64, ppc, ppc64, or s390x +#-a always,exit -F arch=b32 -S fchown32 -S chown32 -S lchown32 + +-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr +-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr
      -The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse amoung both authorized and -unauthorized users. +The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. @@ -304,7 +423,7 @@ loss.
      -Ensure <tt>auditd</tt> Collects Files Deletion Events by User +Ensure <tt>auditd</tt> Collects File Deletion Events At a minimum the audit system should collect file deletion events for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as -- 1.7.1