Resolve information before writing to audit logs

An XCCDF Rule

Description

To configure Audit daemon to resolve all uid, gid, syscall, architecture, and socket address information before writing the events to disk, set log_format to ENRICHED in /etc/audit/auditd.conf.

Rationale

If option log_format isn't set to ENRICHED, the audit records will be stored in a format exactly as the kernel sends them.

ID: xccdf_org.ssgproject.content_rule_auditd_log_format
Severity: Low
References: CCI-000366

AU-3 CM-6

FAU_GEN.1.2

SRG-OS-000255-GPOS-00096 SRG-OS-000480-GPOS-00227

SRG-APP-000096-CTR-000175 SRG-APP-000097-CTR-000180 SRG-APP-000098-CTR-000185 SRG-APP-000099-CTR-000190 SRG-APP-000100-CTR-000195 SRG-APP-000100-CTR-000200 SRG-APP-000109-CTR-000215 SRG-APP-000290-CTR-000670 SRG-APP-000357-CTR-000800
Updated: about 1 year ago

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6  - auditd_log_format
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Resolve information before writing to audit logs
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)^\s*log_format\s*=\s*
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)^\s*log_format\s*=\s*
      state: absent
    when: dupes.found is defined and dupes.found > 1

  - name: Insert correct line to /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)^\s*log_format\s*=\s*
      line: log_format = ENRICHED
      state: present
  when:
  - '"auditd" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6
  - auditd_log_format
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && dpkg-query --show --showformat='${db:Status-Status}\n' 'auditd' 2>/dev/null | grep -q installed; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*log_format\s*=\s*/Id" "/etc/audit/auditd.conf"else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "log_format = ENRICHED" >> "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Resolve information before writing to audit logs

Description

Rationale

Remediation - Ansible

Remediation - Shell Script