-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
"Record Attempts to Alter Logon and Logout Events" issues on Ubuntu 22.04 #11902
Comments
we don't yet support CIS v2.0.0 as you can see here: |
I believe that as a short solution, you could just send a PR removing |
Same issue is present also using CIS v1.0.0 4.1.3.12 Ensure login and logout events are collected - Page 492 |
Changes for tallylog is ready. I need only to commit and create a PR. What about /var/log/faillog ? |
You should replace Just a reminder to move the ids from one rule.yml to the other. |
Description of problem:
2 rules using "CIS Ubuntu 22.04 Level 2 Server Benchmark" fails in the "Record Attempts to Alter Logon and Logout Events" section:
They look for /var/log/faillog and /var/log/tallylog files, but none of these were mentioned in the "CIS Ubuntu Linux 22.04 LTS Benchmark" guide (see 6.3.3.12 Ensure login and logout events are collected - Page 816):
SCAP Security Guide Version:
master branch
Operating System Version:
Ubuntu 22.04 LTS
Steps to Reproduce:
-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock -p wa -k logins
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level2_server --rule xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillog ssg-ubuntu2204-ds.xml
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level2_server --rule xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog /root/scap-security-guide/build/ssg-ubuntu2204-ds.xml
Actual Results:
Expected Results:
Result pass
On Ubuntu 22.04 pam_tally2 was replaced by pam_faillock and the CIS guide refer to pam_faillock.
Why "/var/log/faillog" is also checked but not mentioned in the CIS guide?
Who should be updated? The "CIS Ubuntu Linux 22.04
LTS Benchmark" guide or the "SCAP Security Guide" ?
The text was updated successfully, but these errors were encountered: