Cis Ubuntu2004 V300 6 3 3 21

CIS Ubuntu 20.04 LTS Benchmark v3.0.0 - 6.3.3.21

Control: Ensure the running and on disk configuration is the same

Profile Applicability: Level 2 - Server, Level 2 - Workstation

Description: Verify that the on disk and running audit configurations are the same to ensure that audit logging is consistent and captures all expected events.

Rationale: Ensuring the on disk and running configurations match prevents situations where audit rules are configured but not active, potentially missing critical security events. Discrepancies can occur when rules are modified but not loaded, or when the system configuration has been altered without proper documentation.

Audit

Run the following command to compare on disk and running configurations:

#!/usr/bin/env bash
{
  echo "Checking if running configuration matches on-disk configuration..."

  # Get running config
  auditctl -l > /tmp/running_audit.tmp

  # Generate on-disk config
  augenrules --check > /tmp/ondisk_audit.tmp 2>&1

  # Compare
  if diff /tmp/running_audit.tmp /tmp/ondisk_audit.tmp &>/dev/null; then
    echo "PASS: Running and on-disk configurations match"
  else
    echo "FAIL: Running and on-disk configurations differ"
    echo "Differences:"
    diff /tmp/running_audit.tmp /tmp/ondisk_audit.tmp
  fi

  # Cleanup
  rm -f /tmp/running_audit.tmp /tmp/ondisk_audit.tmp
}

Alternatively, check if the configurations match:

augenrules --check

Expected output:

/sbin/augenrules: No change

Remediation

If the running and on-disk configurations differ, load the on-disk configuration to make them match:

augenrules --load

If the audit configuration is immutable (auditctl -e 2), a system reboot will be required to load the on-disk configuration:

if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then
  printf "Reboot required to load rules\n"
  # Schedule a reboot or notify administrator
fi

Additional Information:

The augenrules --check command compares the running audit configuration with the rules defined in /etc/audit/rules.d/. If there are differences, it indicates that:

• Rules have been added/modified in /etc/audit/rules.d/ but not loaded
• The running configuration has been altered using auditctl without updating on-disk rules
• The system was not rebooted after making changes while in immutable mode

Best Practices:

1. Always use /etc/audit/rules.d/*.rules files for persistent audit rules
2. After modifying rules, run augenrules --load to apply changes
3. Verify changes with augenrules --check
4. In production environments with immutable audit config (-e 2), plan maintenance windows for rule changes
5. Document all audit rule changes in configuration management

CIS Controls:

• v8: 8.2 Collect Audit Logs - Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.
• v8: 8.5 Collect Detailed Audit Logs - Configure detailed audit logging for enterprise assets containing sensitive data.
• v7: 6.2 Activate audit logging - Ensure that local logging has been enabled on all systems and networking devices.
• v7: 6.3 Enable Detailed Logging - Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.

MITRE ATT&CK Mappings:

• Techniques: T1562, T1562.001
• Tactics: TA0005
• Mitigations: M1022

References:

• NIST SP 800-53 Rev. 5: AU-2, AU-3, AU-12
• man 8 augenrules
• man 8 auditctl