SLEM 5 must audit all uses of the sudoers file and all files in the "/etc/sudoers.d/" directory.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-261465	SLEM-05-654210	SV-261465r996802_rule		Medium

Description
Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.

STIG	Date
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide	2024-06-04

Details

Check Text ( C-65194r996800_chk )
Verify SLEM 5 generates audit records when successful/unsuccessful attempts to access the "/etc/sudoers" file and files in the "/etc/sudoers.d/" directory with the following command: > sudo auditctl -l \| grep -w '/etc/sudoers' -w /etc/sudoers -p wa -k privileged-actions -w /etc/sudoers.d -p wa -k privileged-actions If the commands do not return output that match the examples, this is a finding. Notes: The "-k" allows for specifying an arbitrary identifier. The string following "-k" does not need to match the example output above.

Check Text ( C-65194r996800_chk )

Verify SLEM 5 generates audit records when successful/unsuccessful attempts to access the "/etc/sudoers" file and files in the "/etc/sudoers.d/" directory with the following command:

> sudo auditctl -l | grep -w '/etc/sudoers'
-w /etc/sudoers -p wa -k privileged-actions
-w /etc/sudoers.d -p wa -k privileged-actions

If the commands do not return output that match the examples, this is a finding.

Notes: The "-k" allows for specifying an arbitrary identifier. The string following "-k" does not need to match the example output above.

Fix Text (F-65102r996801_fix)
Configure SLEM 5 to generate audit records when successful/unsuccessful attempts to access the "/etc/sudoers" file and files in the "/etc/sudoers.d/" directory. Add or modify the following lines in "/etc/audit/rules.d/audit.rules" file: -w /etc/sudoers -p wa -k privileged-actions -w /etc/sudoers.d -p wa -k privileged-actions To reload the rules file, restart the audit daemon: > sudo systemctl restart auditd.service or issue the following command: > sudo augenrules --load

Fix Text (F-65102r996801_fix)

Configure SLEM 5 to generate audit records when successful/unsuccessful attempts to access the "/etc/sudoers" file and files in the "/etc/sudoers.d/" directory.

Add or modify the following lines in "/etc/audit/rules.d/audit.rules" file:

-w /etc/sudoers -p wa -k privileged-actions

-w /etc/sudoers.d -p wa -k privileged-actions

To reload the rules file, restart the audit daemon:

> sudo systemctl restart auditd.service

or issue the following command:

> sudo augenrules --load