-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Rule "Configure AIDE to Verify the Audit Tools" fails on Ubuntu 22.04 #11895
Comments
@marcofortina there are a lot of inconsistencies in your bug report:
|
Sorry... wrong cut & paste :( reproduce steps updated with the correct rule |
could you also post your aide.conf |
|
The root cause is the check of /usr/sbin/audispd in the aide.conf file, but this executable was removed in auditd package (merged with auditd): linux-audit/audit-userspace@9c74da5 and may be much more commits on linux-audit package. CIS Ubuntu Linux 22.04 LTS Benchmark also do not mention audispd package to be added in /etc/aide/aide.conf file (please check 6.1.3 Ensure cryptographic mechanisms are used to protect the |
it is understood, just trying to get your report done correctly. |
Description of problem:
This rule is looking for /usr/sbin/audispd in file /etc/aide/aide.conf on Ubuntu 22.04 but this program does not exists anymore.
SCAP Security Guide Version:
master branch
Operating System Version:
Ubuntu 22.04 LTS
Steps to Reproduce:
copy the datastream to a UBUNTU 22.04 LTS VM
Actual Results:
Expected Results:
Result pass
Additional Information/Debugging Steps:
In the CIS guide CIS_Ubuntu_Linux_22.04_LTS_Benchmark_v1.0.0.pdf, the process audispd is never mentioned and this process was also removed from the auditd package.
File
product_properties/10-aide-audit.yml
contains:aide_also_checks_audispd setting is wrong for Debian > 10 or Ubuntu > 20.04, where this executable do not exists anymore, then extra checks should be included inside this file:
I will create a PR for this.
The text was updated successfully, but these errors were encountered: