cyberstrikeus CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.3.3
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
sudo can use a custom log file.
Rationale
A sudo log file simplifies auditing of sudo commands.
Audit Procedure
Command Line
Run the following command to verify that sudo has a custom log file configured:
grep -rPsi '^\h*Defaults\h+([^#]+,\h*)?logfile\h*=\h*(")?[\/\w]+(")?' /etc/sudoers /etc/sudoers.d/
Expected Result
Defaults logfile="/var/log/sudo.log"
Remediation
Command Line
Edit the file /etc/sudoers or a file in /etc/sudoers.d/ with visudo and add the following line:
Defaults logfile="/var/log/sudo.log"
References
- NIST SP 800-53 Rev. 5: AU-3, AU-12
CIS Controls
v8 - 8.5 Collect Detailed Audit Logs - Configure detailed audit logging for enterprise assets containing sensitive data.
v7 - 6.3 Enable Detailed Logging.
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Assessment Status
Automated