[PATCH 09/24] - Updated 800-53 paragraph - Included sample script to pull all priv. commands - Included output from default RHEL6 install

Shawn Wells shawn at redhat.com
Wed Feb 22 03:45:00 UTC 2012


---
 rhel6/src/input/system/auditing.xml |   45 +++++++++++++++++++++++++++++++----
 1 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index cb8360c..a950096 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -269,12 +269,47 @@ these events could serve as evidence of malicious intent and potential system co
 
 <Rule id="audit_privileged_commands">
 <title>Ensure <tt>auditd</tt> Collects Information on the Use of Privileged Commands</title>
-<description>At a minimum the audit system should collect the
-execution of privileged commands for all users and root. Add the
-following to <tt>/etc/audit/audit.rules</tt>:
+<description>At a minimum the audit system should collect the execution of privileged commands for all users and root. To find binary applications which are privileged, you can run the script included below. This script will create the audit rules needed, of which should be placed in <tt>/etc/audit/audit.rules</tt>. From a bash prompt, run the following script:
 <br />
-<pre>
--a always,exit -F path=/bin/ping -F perm=x -F auid&gt;=500 -F auid!=4294967295 -k privileged</pre>
+<pre>for privCommand in `find / -type f -perm -04000 2>/dev/null`
+do 
+  echo "-a always,exit -F path=$privCommand -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands"
+done</pre>
+<br />
+This script will give you several lines of output, and the output below is from a default install of Red Hat Enterprise Linux 6:
+<pre>-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/libexec/polkit-1/polkit-agent-helper-1 -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/sbin/suexec -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/at -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/pkexec -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/ksu -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/Xorg -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/lib64/dbus-1/dbus-daemon-launch-helper -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/umount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/fusermount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/su -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/ping6 -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/ping -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands
+-a always,exit -F path=/bin/mount -F perm=x -F auid>500 -F auid!=4294967295 -k audit_privileged_commands</pre>
+<br />
+Take the output of the script and place it into <tt>/etc/audit/audit.rules</tt>.
 </description>
 
 <ident cce="14296-8" />
-- 
1.7.1


--Nq2Wo0NMKNjxTN9z--


More information about the scap-security-guide mailing list