Skybox Appliance 6000 Quick Start Guide
Skybox version 11.6.100
67
RECOMMENDATION
SCORED
DESCRIPTION
/var/log/lastlog
maintain records of the last time a
user successfully logged in. The
/var/run/failock
directory maintains records of login failures via the
pam_
faillock
module. The file
/var/run/utmp
file tracks all
currently logged in users. The
/var/log/wtmp
file tracks
logins, logouts, shutdown, and reboot events. All audit
records are tagged with the identifier ‘session’. The file
/var/log/btmp
keeps track of failed login attempts and
can be read by entering the command
/usr/bin/last
-f /var/log/btmp
. All audit records are tagged with
the identifier ‘logins’.
Rationale: Monitoring login and logout events could
provide a system administrator with information associated
with brute force attacks against user logins. Monitoring
session information files for changes could alert a system
administrator to logins occurring at unusual hours, which
could indicate intruder activity (for example, a user logging
in at a time when they do not normally log in).
4.1.13
ü
Ensure that successful file system mounts are collected.
Monitor the use of the mount system call. The
mount
(and
umount
) system call controls the mounting and
unmounting of file systems.
Rationale: It is highly unusual for a non-privileged user to
mount file systems to the system. Although tracking mount
commands gives the system administrator evidence that
external media may have been mounted (based on a
review of the source of the mount and confirming that it is
an external media type), it does not conclusively indicate
that data was exported to the media.
4.1.14
ü
Ensure that file deletion events by users are collected.
Monitor the use of system calls associated with the
deletion or renaming of files and file attributes. This
configuration statement sets up monitoring for
unlink
(remove a file),
unlinkat
(remove a file attribute),
rename
(rename a file) and
renameat
(rename a file
attribute) system calls and tags them with the identifier
‘delete’.
Rationale: Monitoring these calls from non-privileged
users could provide a system administrator with evidence
that inappropriate removal of files and file attributes
associated with protected files is occurring. This audit
option looks at all events; system administrators want to
look for specific privileged files that are being deleted or
altered.
4.1.15
ü
Ensure that changes to the system administration scope
(
sudoers
) are collected. Monitor scope changes for
system administrations. If the system has been properly
configured to force system administrators to log in as
themselves first and then use the
sudo
command to
execute privileged commands, it is possible to monitor
