77 lines
4.3 KiB
Django/Jinja
77 lines
4.3 KiB
Django/Jinja
# CIS Ubuntu 24.04 - regles d'audit detaillees restantes (6.2.3.4-6.2.3.19)
|
|
# UID_MIN lu dynamiquement depuis /etc/login.defs sur cet host : {{ uid_min }}
|
|
|
|
# 6.2.3.4 - changements date/heure
|
|
-a always,exit -F arch=b64 -S adjtimex,settimeofday -k time-change
|
|
-a always,exit -F arch=b32 -S adjtimex,settimeofday -k time-change
|
|
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -k time-change
|
|
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -k time-change
|
|
-w /etc/localtime -p wa -k time-change
|
|
|
|
# 6.2.3.5 - changements environnement reseau du systeme
|
|
-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale
|
|
-a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale
|
|
-w /etc/issue -p wa -k system-locale
|
|
-w /etc/issue.net -p wa -k system-locale
|
|
-w /etc/hosts -p wa -k system-locale
|
|
-w /etc/networks -p wa -k system-locale
|
|
-w /etc/network/ -p wa -k system-locale
|
|
-w /etc/netplan/ -p wa -k system-locale
|
|
|
|
# 6.2.3.7 - tentatives d'acces fichier echouees
|
|
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>={{ uid_min }} -F auid!=unset -k access
|
|
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>={{ uid_min }} -F auid!=unset -k access
|
|
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>={{ uid_min }} -F auid!=unset -k access
|
|
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>={{ uid_min }} -F auid!=unset -k access
|
|
|
|
# 6.2.3.8 - modifications informations user/group
|
|
-w /etc/group -p wa -k identity
|
|
-w /etc/passwd -p wa -k identity
|
|
-w /etc/gshadow -p wa -k identity
|
|
-w /etc/shadow -p wa -k identity
|
|
-w /etc/security/opasswd -p wa -k identity
|
|
-w /etc/nsswitch.conf -p wa -k identity
|
|
-w /etc/pam.conf -p wa -k identity
|
|
-w /etc/pam.d -p wa -k identity
|
|
|
|
# 6.2.3.9 - modifications permissions discretionnaires (DAC)
|
|
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
|
|
-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
|
|
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
|
|
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
|
|
-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
|
|
-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
|
|
|
|
# 6.2.3.10 - montages systeme de fichiers reussis
|
|
-a always,exit -F arch=b32 -S mount -F auid>={{ uid_min }} -F auid!=unset -k mounts
|
|
-a always,exit -F arch=b64 -S mount -F auid>={{ uid_min }} -F auid!=unset -k mounts
|
|
|
|
# 6.2.3.11 - informations d'initiation de session
|
|
-w /var/run/utmp -p wa -k session
|
|
-w /var/log/wtmp -p wa -k session
|
|
-w /var/log/btmp -p wa -k session
|
|
|
|
# 6.2.3.12 - evenements login/logout
|
|
-w /var/log/lastlog -p wa -k logins
|
|
-w /var/run/faillock -p wa -k logins
|
|
|
|
# 6.2.3.13 - suppressions de fichiers par les utilisateurs
|
|
-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>={{ uid_min }} -F auid!=unset -F key=delete
|
|
-a always,exit -F arch=b32 -S rename,unlink,unlinkat,renameat -F auid>={{ uid_min }} -F auid!=unset -F key=delete
|
|
|
|
# 6.2.3.14 - modifications du controle d'acces obligatoire (AppArmor)
|
|
-w /etc/apparmor/ -p wa -k MAC-policy
|
|
-w /etc/apparmor.d/ -p wa -k MAC-policy
|
|
|
|
# 6.2.3.15-17 - commandes chcon / setfacl / chacl
|
|
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k perm_chng
|
|
-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k perm_chng
|
|
-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k perm_chng
|
|
|
|
# 6.2.3.18 - commande usermod
|
|
-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k usermod
|
|
|
|
# 6.2.3.19 - chargement/dechargement/modification de modules noyau
|
|
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>={{ uid_min }} -F auid!=unset -k kernel_modules
|
|
-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k kernel_modules
|