Rspec HTML Reports - CIS 4 Logging and Auditing

CIS 4 Logging and Auditing

Group Summary

81 Examples

OS Description

OS	ubuntu
Release	18.04
Arch	x86_64
Cloud	AZ
Target	51.140.231.26

Filter rules by their result

pass

pending

failed

Execution Date: 2019-07-05 17:23:28 +0100

# Example Duration Status

1

4.1.2 Ensure auditd service is enabled

0.17049

passed

2

4.2.1.1 Ensure rsyslog Service is enabled

0.18977

passed

3

4.2.1.2 Ensure logging is configured

Skipped: How to check it

0.00032

pending

4

4.2.1.3 Ensure rsyslog default file permissions configured

0.17697

passed

5

4.2.1.4 Ensure rsyslog is configured to send logs to a remote log host

RSpec::Expectations::ExpectationNotMetError

expected "" to match /^\s*\*\.\*\s+@/
Diff:[0m
[0m[34m@@ -1,2 +1,2 @@
[0m[31m-/^\s*\*\.\*\s+@/
[0m[32m+""
[0m

Backtrace:

./spec/cis/4.Logging_auditing_spec.rb:252:in `block (2 levels) in '

			#*.*[TAB][TAB]@

--->			expect(command('grep "^\*\.\*[^I][^I]\*@" \/etc\/rsyslog.conf').stdout).to match(/^\s*\*\.\*\s+@/)
		else
			skip('rsyslog is not installed')
		end
	end

0.18140

failed

6

4.2.2.1 Ensure syslog-ng service is enabled

Skipped: syslog-ng is not installed

0.00035

pending

7

4.2.2.2 Ensure logging is configured

Skipped: syslog-ng is not installed

0.00023

pending

8

4.2.2.3 Ensure syslog-ng default file permissions configured

Skipped: syslog-ng is not installed

0.00023

pending

9

4.2.2.4 Ensure syslog-ng is configured to send logs to a remote log host

Skipped: syslog-ng is not installed

0.00027

pending

10

4.2.2.5 Ensure remote syslog-ng messages are only accepted on designated log hosts

Skipped: syslog-ng is not installed

0.00023

pending

11

4.2.3 Ensure rsyslog or syslog-ng is installed

Skipped: syslog-ng is not installed

0.00026

pending

12

4.1.3 Ensure auditing for processes that start prior to auditd is enabled File "/boot/grub/grub.cfg" content should match /^\slinux.audit=1/

0.17580

passed

13

File "/etc/audit/auditd.conf" 4.1.1.1 Ensure audit log storage size is configured content should match /^max_log_file = \d+/

0.18032

passed

14

File "/etc/audit/auditd.conf" 4.1.1.2 Ensure system is disabled when audit logs are full content should match /^space_left_action = email/

0.00109

passed

15

File "/etc/audit/auditd.conf" 4.1.1.2 Ensure system is disabled when audit logs are full content should match /^action_mail_acct = root/

0.00096

passed

16

File "/etc/audit/auditd.conf" 4.1.1.2 Ensure system is disabled when audit logs are full content should match /^admin_space_left_action = halt/

RSpec::Expectations::ExpectationNotMetError

expected "#\n# This file controls the configuration of the audit daemon\n#\n\nlocal_events = yes\nwrite_logs =...b5 = no\nkrb5_principal = auditd\n##krb5_key_file = /etc/audit/audit.key\ndistribute_network = no\n" to match /^admin_space_left_action = halt/
Diff:[0m
[0m[34m@@ -1,2 +1,38 @@
[0m[31m-/^admin_space_left_action = halt/
[0m[32m+#
[0m[32m+# This file controls the configuration of the audit daemon
[0m[32m+#
[0m[32m+
[0m[32m+local_events = yes
[0m[32m+write_logs = yes
[0m[32m+log_file = /var/log/audit/audit.log
[0m[32m+log_group = adm
[0m[32m+log_format = RAW
[0m[32m+flush = INCREMENTAL_ASYNC
[0m[32m+freq = 50
[0m[32m+max_log_file = 8
[0m[32m+num_logs = 5
[0m[32m+priority_boost = 4
[0m[32m+disp_qos = lossy
[0m[32m+dispatcher = /sbin/audispd
[0m[32m+name_format = NONE
[0m[32m+##name = mydomain
[0m[32m+max_log_file_action = ROTATE
[0m[32m+space_left = 7399
[0m[32m+space_left_action = email
[0m[32m+verify_email = yes
[0m[32m+action_mail_acct = root
[0m[32m+admin_space_left = 50
[0m[32m+admin_space_left_action = SUSPEND
[0m[32m+disk_full_action = SUSPEND
[0m[32m+disk_error_action = SUSPEND
[0m[32m+use_libwrap = yes
[0m[32m+##tcp_listen_port = 60
[0m[32m+tcp_listen_queue = 5
[0m[32m+tcp_max_per_addr = 1
[0m[32m+##tcp_client_ports = 1024-65535
[0m[32m+tcp_client_max_idle = 0
[0m[32m+enable_krb5 = no
[0m[32m+krb5_principal = auditd
[0m[32m+##krb5_key_file = /etc/audit/audit.key
[0m[32m+distribute_network = no
[0m

Backtrace:

./spec/cis/4.Logging_auditing_spec.rb:47:in `block (4 levels) in '

			its(:content) { should match /^action_mail_acct = root/ }
--->			its(:content) { should match /^admin_space_left_action = halt/ }
		end

		describe '4.1.1.3 Ensure audit logs are not automatically deleted' do
			its(:content) { should match /^max_log_file_action = keep_logs/ }

0.00209

failed

17

File "/etc/audit/auditd.conf" 4.1.1.3 Ensure audit logs are not automatically deleted content should match /^max_log_file_action = keep_logs/

RSpec::Expectations::ExpectationNotMetError

expected "#\n# This file controls the configuration of the audit daemon\n#\n\nlocal_events = yes\nwrite_logs =...b5 = no\nkrb5_principal = auditd\n##krb5_key_file = /etc/audit/audit.key\ndistribute_network = no\n" to match /^max_log_file_action = keep_logs/
Diff:[0m
[0m[34m@@ -1,2 +1,38 @@
[0m[31m-/^max_log_file_action = keep_logs/
[0m[32m+#
[0m[32m+# This file controls the configuration of the audit daemon
[0m[32m+#
[0m[32m+
[0m[32m+local_events = yes
[0m[32m+write_logs = yes
[0m[32m+log_file = /var/log/audit/audit.log
[0m[32m+log_group = adm
[0m[32m+log_format = RAW
[0m[32m+flush = INCREMENTAL_ASYNC
[0m[32m+freq = 50
[0m[32m+max_log_file = 8
[0m[32m+num_logs = 5
[0m[32m+priority_boost = 4
[0m[32m+disp_qos = lossy
[0m[32m+dispatcher = /sbin/audispd
[0m[32m+name_format = NONE
[0m[32m+##name = mydomain
[0m[32m+max_log_file_action = ROTATE
[0m[32m+space_left = 7399
[0m[32m+space_left_action = email
[0m[32m+verify_email = yes
[0m[32m+action_mail_acct = root
[0m[32m+admin_space_left = 50
[0m[32m+admin_space_left_action = SUSPEND
[0m[32m+disk_full_action = SUSPEND
[0m[32m+disk_error_action = SUSPEND
[0m[32m+use_libwrap = yes
[0m[32m+##tcp_listen_port = 60
[0m[32m+tcp_listen_queue = 5
[0m[32m+tcp_max_per_addr = 1
[0m[32m+##tcp_client_ports = 1024-65535
[0m[32m+tcp_client_max_idle = 0
[0m[32m+enable_krb5 = no
[0m[32m+krb5_principal = auditd
[0m[32m+##krb5_key_file = /etc/audit/audit.key
[0m[32m+distribute_network = no
[0m

Backtrace:

./spec/cis/4.Logging_auditing_spec.rb:51:in `block (4 levels) in '

		describe '4.1.1.3 Ensure audit logs are not automatically deleted' do
--->			its(:content) { should match /^max_log_file_action = keep_logs/ }
		end

	end

0.00210

failed

18

File "/etc/audit/audit.rules" 4.1.12 Ensure use of privileged commands is collected

Skipped: How to check it

0.00036

pending

19

File "/etc/audit/audit.rules" 4.1.4 Ensure events that modify date and time information are collected content should match /^-a (always,exit|exit,always) .arch=b64. adjtimex /

0.16075

passed

20

File "/etc/audit/audit.rules" 4.1.4 Ensure events that modify date and time information are collected content should match /^-a (always,exit|exit,always) .arch=b64. settimeofday /

0.00147

passed

21

File "/etc/audit/audit.rules" 4.1.4 Ensure events that modify date and time information are collected content should match /^-a (always,exit|exit,always) .arch=b64. clock_settime /

0.00105

passed

22

File "/etc/audit/audit.rules" 4.1.4 Ensure events that modify date and time information are collected content should match /^-w \/etc\/localtime -p wa/

0.00102

passed

23

File "/etc/audit/audit.rules" 4.1.5 Ensure events that modify user/group information are collected content should match /^-w \/etc\/group -p wa/

0.00105

passed

24

File "/etc/audit/audit.rules" 4.1.5 Ensure events that modify user/group information are collected content should match /^-w \/etc\/passwd -p wa/

0.00104

passed

25

File "/etc/audit/audit.rules" 4.1.5 Ensure events that modify user/group information are collected content should match /^-w \/etc\/gshadow -p wa/

0.00100

passed

26

File "/etc/audit/audit.rules" 4.1.5 Ensure events that modify user/group information are collected content should match /^-w \/etc\/shadow -p wa/

0.00101

passed

27

File "/etc/audit/audit.rules" 4.1.5 Ensure events that modify user/group information are collected content should match /^-w \/etc\/security\/opasswd -p wa/

0.00094

passed

28

File "/etc/audit/audit.rules" 4.1.6 Ensure events that modify the system's network environment are collected content should match /^-a (always,exit|exit,always).arch=b64. sethostname /

0.00106

passed

29

File "/etc/audit/audit.rules" 4.1.6 Ensure events that modify the system's network environment are collected content should match /^-a (always,exit|exit,always).arch=b64. setdomainname /

0.00108

passed

30

File "/etc/audit/audit.rules" 4.1.6 Ensure events that modify the system's network environment are collected content should match /^-w \/etc\/issue -p wa/

0.00103

passed

31

File "/etc/audit/audit.rules" 4.1.6 Ensure events that modify the system's network environment are collected content should match /^-w \/etc\/issue.net -p wa/

0.00101

passed

32

File "/etc/audit/audit.rules" 4.1.6 Ensure events that modify the system's network environment are collected content should match /^-w \/etc\/hosts -p wa/

0.00104

passed

33

File "/etc/audit/audit.rules" 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected content should match /^-w \/etc\/selinux\/ -p wa/

0.00097

passed

34

File "/etc/audit/audit.rules" 4.1.8 Ensure login and logout events are collected content should match /^-w \/var\/log\/lastlog -p wa/

0.00104

passed

35

File "/etc/audit/audit.rules" 4.1.8 Ensure login and logout events are collected content should match /^-w \/var\/run\/faillock\/ -p wa/

0.00096

passed

36

File "/etc/audit/audit.rules" 4.1.9 Ensure session initiation information is collected content should match /^-w \/var\/run\/utmp -p wa/

0.00100

passed

37

File "/etc/audit/audit.rules" 4.1.9 Ensure session initiation information is collected content should match /^-w \/var\/log\/wtmp -p wa/

0.00099

passed

38

File "/etc/audit/audit.rules" 4.1.9 Ensure session initiation information is collected content should match /^-w \/var\/log\/btmp -p wa/

0.00098

passed

39

File "/etc/audit/audit.rules" 4.1.10 Ensure discretionary access control permission modification events are collected content should match /^-a (always,exit|exit,always) .arch=b64. fchmodat /

0.00104

passed

40

File "/etc/audit/audit.rules" 4.1.10 Ensure discretionary access control permission modification events are collected content should match /^-a (always,exit|exit,always) .arch=b64. fchmod /

0.00102

passed

41

File "/etc/audit/audit.rules" 4.1.10 Ensure discretionary access control permission modification events are collected content should match /^-a (always,exit|exit,always) .arch=b64. chmod /

0.00102

passed

42

File "/etc/audit/audit.rules" 4.1.10 Ensure discretionary access control permission modification events are collected content should match /^-a (always,exit|exit,always) .arch=b64. setxattr/

0.00113

passed

43

File "/etc/audit/audit.rules" 4.1.10 Ensure discretionary access control permission modification events are collected content should match /^-a (always,exit|exit,always) .arch=b64. lsetxattr /

0.00105

passed

44

File "/etc/audit/audit.rules" 4.1.10 Ensure discretionary access control permission modification events are collected content should match /^-a (always,exit|exit,always) .arch=b64. fsetxattr /

0.00111

passed

45

File "/etc/audit/audit.rules" 4.1.10 Ensure discretionary access control permission modification events are collected content should match /^-a (always,exit|exit,always) .arch=b64. removexattr /

0.00106

passed

46

File "/etc/audit/audit.rules" 4.1.10 Ensure discretionary access control permission modification events are collected content should match /^-a (always,exit|exit,always) .arch=b64. lremovexattr /

0.00104

passed

47

File "/etc/audit/audit.rules" 4.1.10 Ensure discretionary access control permission modification events are collected content should match /^-a (always,exit|exit,always) .arch=b64. fremovexattr /

0.00109

passed

48

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. creat .* exit=-EACCES/

0.00108

passed

49

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. open .* exit=-EACCES/

0.00107

passed

50

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. openat .* exit=-EACCES/

0.00109

passed

51

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. truncate .* exit=-EACCES/

0.00108

passed

52

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. ftruncate .* exit=-EACCES/

0.00110

passed

53

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. creat .* exit=-EPERM/

0.00106

passed

54

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. open .* exit=-EPERM/

0.00111

passed

55

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. openat .* exit=-EPERM/

0.00109

passed

56

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. truncate .* exit=-EPERM/

0.00105

passed

57

File "/etc/audit/audit.rules" 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected content should match /^-a (always,exit|exit,always) .arch=b64. ftruncate .* exit=-EPERM/

0.00111

passed

58

File "/etc/audit/audit.rules" 4.1.13 Ensure successful file system mounts are collected content should match /^-a (always,exit|exit,always) .arch=b64. mount /

0.00100

passed

59

File "/etc/audit/audit.rules" 4.1.14 Ensure file deletion events by users are collected content should match /^-a (always,exit|exit,always) .arch=b64. unlink /

0.00097

passed

60

File "/etc/audit/audit.rules" 4.1.14 Ensure file deletion events by users are collected content should match /^-a (always,exit|exit,always) .arch=b64. unlinkat /

0.00115

passed

61

File "/etc/audit/audit.rules" 4.1.14 Ensure file deletion events by users are collected content should match /^-a (always,exit|exit,always) .arch=b64. rename /

0.00102

passed

62

File "/etc/audit/audit.rules" 4.1.14 Ensure file deletion events by users are collected content should match /^-a (always,exit|exit,always) .arch=b64. renameat /

0.00111

passed

63

File "/etc/audit/audit.rules" 4.1.15 Ensure changes to system administration scope (sudoers) is collected content should match /^-w \/etc\/sudoers -p wa/

0.00098

passed

64

File "/etc/audit/audit.rules" 4.1.16 Ensure system administrator actions (sudolog) are collected content should match /^-w \/var\/log\/sudo.log -p wa/

0.00098

passed

65

File "/etc/audit/audit.rules" 4.1.17 Ensure kernel module loading and unloading is collected content should match /^-w \/sbin\/insmod -p x/

0.00099

passed

66

File "/etc/audit/audit.rules" 4.1.17 Ensure kernel module loading and unloading is collected content should match /^-w \/sbin\/rmmod -p x/

0.00098

passed

67

File "/etc/audit/audit.rules" 4.1.17 Ensure kernel module loading and unloading is collected content should match /^-w \/sbin\/modprobe -p x/

0.00097

passed

68

File "/etc/audit/audit.rules" 4.1.17 Ensure kernel module loading and unloading is collected content should match /^-a (always,exit|exit,always) .arch=b64. init_module /

0.00114

passed

69

File "/etc/audit/audit.rules" 4.1.17 Ensure kernel module loading and unloading is collected content should match /^-a (always,exit|exit,always) .arch=b64. delete_module /

0.00115

passed

70

File "/etc/audit/audit.rules" 4.1.18 Ensure the audit configuration is immutable content should match /^-e 2/

RSpec::Expectations::ExpectationNotMetError

expected "## This file is automatically generated from /etc/audit/rules.d\n-D\n-b 16384\n-f 1\n-A exclude,alwa...F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged\n-w /var/log/sudo.log -p wa -k actions\n\n" to match /^-e 2/
Diff:[0m
[0m[34m@@ -1,2 +1,220 @@
[0m[31m-/^-e 2/
[0m[32m+## This file is automatically generated from /etc/audit/rules.d
[0m[32m+-D
[0m[32m+-b 16384
[0m[32m+-f 1
[0m[32m+-A exclude,always -F msgtype=CWD
[0m[32m+-a exit,never -F arch=b64 -S unlink -F exe=/usr/lib/systemd/systemd-udevd 
[0m[32m+-a exit,never -F arch=b64 -S mkdir -F subj_type=systemd_logind_t
[0m[32m+-a exit,never -F arch=b64 -S mkdir -F exe=/usr/lib/systemd/systemd
[0m[32m+-a exit,never -F arch=b64 -S rmdir -F exe=/usr/lib/systemd/systemd
[0m[32m+-a exit,never -F arch=b64 -S unlink -F exe=/usr/lib/systemd/systemd
[0m[32m+-w /etc/auditd.conf -k CFG_auditd.conf
[0m[32m+-w /etc/audit.rules -k CFG_audit.rules
[0m[32m+-a exit,always -F arch=b64 -S fchmod -S fchown -S lchown -k ownership_action
[0m[32m+-a exit,always -F arch=b64 -S mkdir -S rmdir -k dir_action
[0m[32m+-a exit,always -F arch=b64 -S unlink -S rename -S link -S symlink -k link_action
[0m[32m+-a exit,always -F arch=b64 -S mknod -k mknod
[0m[32m+-a exit,always -F arch=b64 -S mount -S umount2 -k mount_action
[0m[32m+-a exit,always -F arch=b64 -S adjtimex -S settimeofday -k time_action
[0m[32m+-w /usr/sbin/stunnel -p x -k stunnel
[0m[32m+-w /var/spool/at -k LOG_at
[0m[32m+-w /etc/at.allow -k CFG_at.allow
[0m[32m+-w /etc/at.deny -k CFG_at.deny
[0m[32m+-w /etc/cron.allow -p wa -k CFG_cron.allow
[0m[32m+-w /etc/cron.deny -p wa -k CFG_cron.deny
[0m[32m+-w /etc/cron.d/ -p wa -k CFG_cron.d
[0m[32m+-w /etc/cron.daily/ -p wa -k CFG_cron.daily
[0m[32m+-w /etc/cron.hourly/ -p wa -k CFG_cron.hourly
[0m[32m+-w /etc/cron.monthly/ -p wa -k CFG_cron.monthly
[0m[32m+-w /etc/cron.weekly/ -p wa -k CFG_cron.weekly
[0m[32m+-w /etc/crontab -p wa -k CFG_crontab
[0m[32m+-w /var/spool/cron/root -k CFG_crontab_root
[0m[32m+-w /etc/group -p wa -k CFG_group
[0m[32m+-w /etc/passwd -p wa -k CFG_passwd
[0m[32m+-w /etc/gshadow -p wa -k CFG_gshadow
[0m[32m+-w /etc/shadow -p wa -k CFG_shadow
[0m[32m+-w /etc/security/opasswd -p wa -k CFG_opasswd
[0m[32m+-w /etc/login.defs -p wa -k CFG_login.defs
[0m[32m+-w /etc/securetty -k CFG_securetty
[0m[32m+-w /var/log/faillog -k LOG_faillog
[0m[32m+-w /var/log/lastlog -p wa -k LOG_lastlog
[0m[32m+-w /var/run/faillock/ -p wa -k logins
[0m[32m+-w /etc/hosts -p wa -k CFG_hosts
[0m[32m+-w /etc/inittab -p wa -k CFG_inittab
[0m[32m+-w /etc/ld.so.conf -p wa -k CFG_ld.so.conf
[0m[32m+-w /etc/localtime -p wa -k CFG_localtime
[0m[32m+-w /etc/sysctl.conf -p wa -k CFG_sysctl.conf
[0m[32m+-w /etc/modprobe.conf -p wa -k CFG_modprobe.conf
[0m[32m+-w /etc/pam.d/ -p wa -k pam.d
[0m[32m+-w /etc/aliases -p wa -k CFG_aliases
[0m[32m+-w /etc/postfix/ -p wa -k CFG_postfix
[0m[32m+-w /etc/ssh/sshd_config -k CFG_sshd_config
[0m[32m+-w /etc/issue -p wa -k CFG_issue
[0m[32m+-w /etc/issue.net -p wa -k CFG_issue.net
[0m[32m+-w /etc/sudoers -p wa -k CFG_sudoers
[0m[32m+-w /etc/sudoers.d/ -p wa  -k CFG_sudoers
[0m[32m+-w /etc/ssh/ssh_config -k CFG_ssh
[0m[32m+-a exit,always -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=4294967295 -k execute_binary
[0m[32m+-w /etc/grub2.cfg -p wa -k GRUB
[0m[32m+-w /boot/grub/grub.cfg -p wa -k GRUB
[0m[32m+-w /bin/su -p x -k APPS
[0m[32m+-w /usr/bin/sudo -p x -k APPS
[0m[32m+-w /usr/sbin/visudo -p x -k APPS
[0m[32m+-w /usr/sbin/sudoedit -p x -k APPS
[0m[32m+-w /bin/ping -p x -k APPS
[0m[32m+-w /usr/bin/ssh -p x -k APPS
[0m[32m+-w /usr/bin/scp -p x -k APPS
[0m[32m+-w /usr/bin/sftp -p x -k APPS
[0m[32m+-w /usr/sbin/useradd  -p x -k USERacc
[0m[32m+-w /usr/sbin/userdel  -p x -k USERacc
[0m[32m+-w /usr/sbin/usermod  -p x -k USERacc
[0m[32m+-w /usr/sbin/groupadd -p x -k GROUPacc
[0m[32m+-w /usr/sbin/groupdel -p x -k GROUPacc
[0m[32m+-w /usr/sbin/groupmod -p x -k GROUPacc
[0m[32m+-w /sbin/pwdb_chkpwd -p x -k SUID
[0m[32m+-w /sbin/pam_timestamp_check -p x -k SUID
[0m[32m+-w /sbin/unix_chkpwd -p x -k SUID
[0m[32m+-w /bin/mount -p x -k SUID
[0m[32m+-w /bin/traceroute6 -p x -k SUID
[0m[32m+-w /bin/umount -p x -k SUID
[0m[32m+-w /bin/traceroute -p x -k SUID
[0m[32m+-w /bin/ping6 -p x -k SUID
[0m[32m+-w /usr/sbin/userisdnctl -p x -k SUID
[0m[32m+-w /usr/sbin/usernetctl -p x -k SUID
[0m[32m+-w /usr/sbin/userhelper -p x -k SUID
[0m[32m+-w /usr/sbin/ccreds_validate -p x -k SUID
[0m[32m+-w /usr/bin/rcp -p x -k SUID
[0m[32m+-w /usr/bin/kgrantpty -p x -k SUID
[0m[32m+-w /usr/bin/rsh -p x -k SUID
[0m[32m+-w /usr/bin/chage -p x -k SUID
[0m[32m+-w /usr/bin/lppasswd -p x -k SUID
[0m[32m+-w /usr/bin/newgrp -p x -k SUID
[0m[32m+-w /usr/bin/gpasswd -p x -k SUID
[0m[32m+-w /usr/bin/kpac_dhcp_helper -p x -k SUID
[0m[32m+-w /usr/bin/sg -p x -k SUID
[0m[32m+-w /usr/bin/at -p x -k SUID
[0m[32m+-w /usr/bin/passwd -p x -k SUID
[0m[32m+-w /usr/bin/chsh -p x -k SUID
[0m[32m+-w /usr/bin/chfn -p x -k SUID
[0m[32m+-w /usr/bin/rlogin -p x -k SUID
[0m[32m+-w /usr/bin/crontab -p x -k SUID
[0m[32m+-w /sbin/netreport -p x -k GUID
[0m[32m+-w /usr/sbin/lockdev -p x -k GUID
[0m[32m+-w /usr/sbin/sendmail.sendmail -p x -k GUID
[0m[32m+-w /usr/bin/write -p x -k GUID
[0m[32m+-w /usr/bin/lockfile -p x -k GUID
[0m[32m+-w /usr/bin/slocate -p x -k GUID
[0m[32m+-w /usr/bin/ssh-agent -p x -k GUID
[0m[32m+-w /usr/bin/wall -p x -k GUID
[0m[32m+-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules
[0m[32m+-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules
[0m[32m+-a always,exit -F arch=b64 -S clock_settime -k audit_time_rules
[0m[32m+-a exit,always -F arch=b64 -S sethostname -S setdomainname -k audit_network_modifications
[0m[32m+-w /etc/selinux/ -p wa -k MAC-policy
[0m[32m+-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S chmod -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S chown -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fchmod -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fchmodat -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fchown -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fchownat -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S lchown -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod
[0m[32m+-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
[0m[32m+-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
[0m[32m+-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid=0 -k access
[0m[32m+-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid=0 -k access
[0m[32m+-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access
[0m[32m+-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access
[0m[32m+-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged-priv_change
[0m[32m+-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged-priv_change
[0m[32m+-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged-priv_change
[0m[32m+-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged-priv_change
[0m[32m+-a always,exit -F path=/var/log/journal -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/write -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/screen -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k export
[0m[32m+-a always,exit -F arch=b64 -S mount -F auid=0 -k export
[0m[32m+-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
[0m[32m+-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid=0 -k delete
[0m[32m+-w /sbin/insmod -p x -k modules
[0m[32m+-w /usr/sbin/insmod -p x -k modules
[0m[32m+-w /sbin/rmmod -p x -k modules
[0m[32m+-w /usr/sbin/rmmod -p x -k modules
[0m[32m+-w /sbin/modprobe -p x -k modules
[0m[32m+-w /usr/sbin/modprobe -p x -k modules
[0m[32m+-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
[0m[32m+-a always,exit -F arch=b64 -S finit_module -k modules
[0m[32m+-a always,exit -F arch=b64 -S create_module -k modules
[0m[32m+-w /bin/chmod -p x -k FOLDER
[0m[32m+-w /bin/chgrp -p x -k FOLDER
[0m[32m+-w /etc/sd_pam.conf -p r -k ACE
[0m[32m+-w /var/log/tallylog -p wa -k logins
[0m[32m+-w /var/run/utmp -p wa -k session
[0m[32m+-w /var/log/wtmp -p wa -k session
[0m[32m+-w /var/log/btmp -p wa -k session
[0m[32m+-a always,exit -F path=/usr/bin/wall -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/write -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/screen -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/bin/locate -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/netreport -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
[0m[32m+-w /var/log/sudo.log -p wa -k actions
[0m

Backtrace:

./spec/cis/4.Logging_auditing_spec.rb:213:in `block (4 levels) in '

			#expect(command('grep "^\s*[^#]" /etc/audit/audit.rules | tail -1').stdout).to match(/-e 2/)

--->			its(:content) { should match /^-e 2/ } # FIXME: no one uses this - Ensure the audit configuration is immutable

		end

	end # /etc/audit/audit.rules

0.00652

failed

71

4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts File "/etc/rsyslog.conf" content should not match /^\$ModLoad\s*imudp/

0.13013

passed

72

4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts File "/etc/rsyslog.conf" content should not match /^\$UDPServerRun/

0.00110

passed

73

4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts File "/etc/rsyslog.conf" content should not match /^\$ModLoad\s*imtcp/

0.00095

passed

74

4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts File "/etc/rsyslog.conf" content should not match /^\$InputTCPServerRun/

0.00092

passed

75

4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts File "/etc/rsyslog.conf" content should not match /^module\(\sload\s=\s*"imudp"\)/

0.00098

passed

76

4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts File "/etc/rsyslog.conf" content should not match /^input\(\stype\s=\s*"imudp"/

0.00096

passed

77

4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts File "/etc/rsyslog.conf" content should not match /^module\(\sload\s=\s*"imtcp"\)/

0.00098

passed

78

4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts File "/etc/rsyslog.conf" content should not match /^input\(\stype\s=\s*"imtcp"/

0.00097

passed

79

4.2.4 Ensure permissions on all logfiles are configured Command "find /var/log -type f -perm /o+rwx,g+wx -ls | egrep -v "/var/log/sa"" stdout should == ""

RSpec::Expectations::ExpectationNotMetError

expected: ""
     got: "     3426      0 -rw-r--r--   1 root     root            0 Jul  4 09:50 /var/log/unattended-upgrades...nfo.log\n     1736      4 -rw-rw-r--   1 root     utmp       292292 Jul  5 12:46 /var/log/lastlog\n" (using ==)
Diff:[0m
[0m[34m@@ -1 +1,12 @@
[0m[32m+     3426      0 -rw-r--r--   1 root     root            0 Jul  4 09:50 /var/log/unattended-upgrades/unattended-upgrades-shutdown.log
[0m[32m+     1756      4 -rw-r--r--   1 root     adm          1104 Jul  5 06:30 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log
[0m[32m+     1728      4 -rw-r--r--   1 root     root          833 Jul  5 06:30 /var/log/unattended-upgrades/unattended-upgrades.log
[0m[32m+     1741     24 -rw-r--r--   1 root     root        24068 Jul  5 06:30 /var/log/apt/eipp.log.xz
[0m[32m+     3499      4 -rw-r--r--   1 root     root         1129 Jul  5 06:30 /var/log/apt/history.log
[0m[32m+     3503     12 -rw-r--r--   1 root     root        11311 Jul  5 06:30 /var/log/dpkg.log
[0m[32m+     1734      8 -rw-rw-r--   1 root     utmp         4992 Jul  5 12:46 /var/log/wtmp
[0m[32m+     1735      8 -rw-rw----   1 root     utmp         7296 Jul  5 15:21 /var/log/btmp
[0m[32m+     1618      4 -rw-r--r--   1 root     root          456 Jul  4 10:49 /var/log/waagent.log
[0m[32m+     3493      0 -rw-r--r--   1 root     root            0 Jul  4 09:51 /var/log/landscape/sysinfo.log
[0m[32m+     1736      4 -rw-rw-r--   1 root     utmp       292292 Jul  5 12:46 /var/log/lastlog
[0m

Backtrace:

./spec/cis/4.Logging_auditing_spec.rb:364:in `block (4 levels) in '

		describe( command('find /var/log -type f -perm /o+rwx,g+wx -ls | egrep -v "/var/log/sa"') ) do
--->			its(:stdout) { should == ""}
		end
    end

	#

0.17347

failed

80

4.3 Ensure logrotate is configured File "/etc/cron.daily/logrotate" should exist

0.15102

passed

81

4.3 Ensure logrotate is configured File "/etc/logrotate.d/rsyslog" should exist

0.17788

passed

Rspec HTML Reports This version by: Nicholas Cross @mohclips - originally @vbanthia and before that @kingsleyh