Skybox Appliance 5500 Quick Start Guide
Skybox version 10.1.200
60
Recommend
ation
Scored Description
system administrator with information associated with brute
force attacks against user logins. Monitoring session
information files for changes could alert a system
administrator to logins occurring at unusual hours, which
could indicate intruder activity (for example, a user logging in
at a time when they do not normally log in).
4.1.13
Ensure that successful file system mounts are collected.
Monitor the use of the mount system call. The
mount
(and
umount
) system call controls the mounting and unmounting of
file systems.
Rationale: It is highly unusual for a non-privileged user to
mount file systems to the system. Although tracking mount
commands gives the system administrator evidence that
external media may have been mounted (based on a review of
the source of the mount and confirming that it is an external
media type), it does not conclusively indicate that data was
exported to the media.
4.1.14
Ensure that file deletion events by users are collected. Monitor
the use of system calls associated with the deletion or
renaming of files and file attributes. This configuration
statement sets up monitoring for
unlink
(remove a file),
unlinkat
(remove a file attribute),
rename
(rename a file) and
renameat
(rename a file attribute) system calls and tags them
with the identifier ‘delete’.
Rationale: Monitoring these calls from non-privileged users
could provide a system administrator with evidence that
inappropriate removal of files and file attributes associated
with protected files is occurring. This audit option looks at all
events; system administrators want to look for specific
privileged files that are being deleted or altered.
4.1.15
Ensure that changes to the system administration scope
(
sudoers
) are collected. Monitor scope changes for system
administrations. If the system has been properly configured to
force system administrators to log in as themselves first and
then use the
sudo
command to execute privileged commands,
it is possible to monitor changes in scope. The file
/etc/sudoers
is written to when the file or its attributes have
changed. The audit records are tagged with the identifier
‘scope’.
Rationale: Changes in the
/etc/sudoers
file can indicate that
an unauthorized change has been made to scope of system
administrator activity.
4.2.2.3
Ensure that
syslog-ng
default file permissions are configured.
syslog-ng
creates log files that do not already exist on the
system. This setting controls the permissions that are applied
to these newly created files.
Rationale: It is important to ensure that log files exist and
have the correct permissions to ensure that sensitive syslog-
ng data is archived and protected.
5.1.1 – 5.1.7
Configuration of
cron
:
•
Ensure that the
cron
daemon is enabled
