>From 73e3ff82aacbbd9f04daaca78f1fd1f3bcc1e4cb Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 21 Feb 2012 22:45:00 -0500 Subject: [PATCH 09/11] - Updated 800-53 paragraph - Included sample script to pull all priv. commands - Included output from default RHEL6 install --- rhel6/src/input/system/auditing.xml | 45 +++++++++++++++++++++++++++++++---- 1 files changed, 40 insertions(+), 5 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index cb8360c..a950096 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -269,12 +269,47 @@ these events could serve as evidence of malicious intent and potential system co Ensure <tt>auditd</tt> Collects Information on the Use of Privileged Commands -At a minimum the audit system should collect the -execution of privileged commands for all users and root. Add the -following to /etc/audit/audit.rules: +At a minimum the audit system should collect the execution of privileged commands for all users and root. To find binary applications which are privileged, you can run the script included below. This script will create the audit rules needed, of which should be placed in /etc/audit/audit.rules. From a bash prompt, run the following script:
-
--a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
+
for privCommand in `find / -type f -perm -04000 2>/dev/null`
+do 
+  echo "-a always,exit -F path=$privCommand -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands"
+done
+
+This script will give you several lines of output, and the output below is from a default install of Red Hat Enterprise Linux 6: +
-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/libexec/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/sbin/suexec -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/at -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/ksu -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/Xorg -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/lib64/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/umount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/fusermount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/su -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/ping6 -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/ping -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/mount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+
+Take the output of the script and place it into /etc/audit/audit.rules.
-- 1.7.1