{ "id": "CB-UBU-AUDIT-027", "standard": "ubuntu", "version": "0.1.1", "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-AUDIT-027", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-AUDIT-027.json", "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-AUDIT-027.yml", "profiles_effective": [ "server-hardened", "desktop-hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-UBU-AUDIT-027", "title": "Audit login records and session files", "finding": { "title": "Tampering with login records is not detected", "description": "The files that record who logged in and failed logins can be edited to hide a session." }, "status": "active", "profiles": [ "server-hardened", "desktop-hardened" ], "risk": { "severity": "low" }, "assessment": "automated", "tags": [ "auditd", "login" ], "description": "auditd rules in `/etc/audit/rules.d/60-cirsec-session.rules`:\n\n- writes to the session records `/run/utmp`, `/var/log/wtmp`, `/var/log/btmp` and, when the\n `wtmpdb` package is installed (not by default up to 26.04), its database in `/var/lib/wtmpdb/`\n (key `session`);\n- writes to `/var/log/lastlog` and to the `pam_faillock` counters in `/run/faillock/`\n (key `logins`).\n", "rationale": "`last`, `lastb`, `who` and `faillock` read these files. Every login writes to them, so the records\nshow logins and logouts; an edit outside a login is a sign of an attempt to erase a session.\n", "impact": "Each login and logout produces a few records.\n", "notes": "`/run/utmp` is used instead of `/var/run/utmp`: `/var/run` is a symbolic link to `/run` and the kernel watches the real path.\n", "setting": { "location": "/etc/audit/rules.d/60-cirsec-session.rules", "default_value": "No audit rules", "recommended_value": "Rules loaded (auditctl -l) and present in /etc/audit/rules.d/60-cirsec-session.rules" }, "audit": { "manual": "1. Run `auditctl -l` as root. It must list the rules shown below (keys `logins`, `session`).\n2. Run `grep -h . /etc/audit/rules.d/*.rules`. The same rules must be present, so they load at boot.\n\nExpected rules, as `auditctl -l` prints them:\n```\n-w /run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k session\n-w /var/log/btmp -p wa -k session\n-w /var/lib/wtmpdb -p wa -k session\n-w /var/log/lastlog -p wa -k logins\n-w /run/faillock -p wa -k logins\n```\n", "checks": [ { "id": "rules", "engine": "shell", "description": "Rules loaded in the kernel and present in /etc/audit/rules.d.", "spec": { "script": "command -v auditctl >/dev/null 2>&1 || { echo \"auditctl not found: auditd is not installed\"; exit 1; }\nwant() {\ncat <<'RULES'\n-w /run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k session\n-w /var/log/btmp -p wa -k session\n-w /var/lib/wtmpdb -p wa -k session\n-w /var/log/lastlog -p wa -k logins\n-w /run/faillock -p wa -k logins\nRULES\n}\nloaded=$(auditctl -l 2>&1) || { echo \"$loaded\"; exit 3; }\ndisk=$(cat /etc/audit/rules.d/*.rules 2>/dev/null)\nn=0 rc=0\nwhile IFS= read -r r; do\n [ -n \"$r\" ] || continue\n n=$((n + 1))\n printf '%s\\n' \"$loaded\" | grep -Fxq -- \"$r\" || { echo \"not loaded: $r\"; rc=1; }\n printf '%s\\n' \"$disk\" | grep -Fxq -- \"$r\" || { echo \"not in /etc/audit/rules.d: $r\"; rc=1; }\ndone </dev/null 2>&1 || { echo \"auditd is not installed\" >&2; exit 1; }\nwant() {\ncat <<'RULES'\n-w /run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k session\n-w /var/log/btmp -p wa -k session\n-w /var/lib/wtmpdb -p wa -k session\n-w /var/log/lastlog -p wa -k logins\n-w /run/faillock -p wa -k logins\nRULES\n}\nf=/etc/audit/rules.d/60-cirsec-session.rules\nt=$(mktemp)\n{ echo '# Written by CIRSEC Baselines CB-UBU-AUDIT-027'; want; } >\"$t\"\nif ! cmp -s \"$t\" \"$f\"; then\n cb_backup \"$f\"\n cat \"$t\" >\"$f\"\nfi\nrm -f \"$t\"\nchmod 640 \"$f\"\nif auditctl -s | grep -q '^enabled 2'; then\n echo \"audit rules are locked (-e 2): reboot to load $f\"\nelse\n augenrules --load >/dev/null\nfi\n" } ] }, "references": [ { "title": "audit.rules(7), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man7/audit.rules.7.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "auditctl(8), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man8/auditctl.8.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R73)", "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf", "publisher": "ANSSI", "kind": "guide", "accessed": "2026-10-19" } ], "mappings": [ { "framework": "anssi-linux", "framework_version": "2.0", "id": "R73", "relation": "partial" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AU-12", "relation": "related" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AC-17(1)", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1070.002" }, { "framework": "mitre-attack", "id": "T1078" } ], "related_controls": [ { "id": "CB-UBU-AUDIT-011", "type": "requires" }, { "id": "CB-UBU-AUDIT-029", "type": "related" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "verified": [ { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "20.04" ], "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic", "notes": "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 2.8.5; passes after reboot with enabled 2." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "22.04" ], "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic", "notes": "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 3.0.7; passes after reboot with enabled 2." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "24.04" ], "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic", "notes": "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 3.1.2; passes after reboot with enabled 2." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "26.04" ], "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic", "notes": "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 4.1.2; passes after reboot with enabled 2." } ], "introduced_in": "0.1.0", "created": "2026-10-19", "updated": "2026-10-19" } }