Ubuntu 22.04 LTS must configure audit tools with a mode of "755" or less permissive.

Vulnerability Discussion

Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information.

Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the access to audit tools.

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

Satisfies: SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098

Check

Verify Ubuntu 22.04 LTS configures the audit tools to have a file permission of "755" or less to prevent unauthorized access by using the following command:

$ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd* /sbin/augenrules
/sbin/auditctl 755
/sbin/aureport 755
/sbin/ausearch 755
/sbin/autrace 755
/sbin/auditd 755
/sbin/audispd-zos-remote 755
/sbin/augenrules 755

If any of the audit tools have a mode more permissive than "0755", this is a finding.

Fix

Configure the audit tools on Ubuntu 22.04 LTS to be protected from unauthorized access by setting the correct permissive mode using the following command:

$ sudo chmod 755

Replace "" with the audit tool that does not have the correct permissions.

Ubuntu 22.04 LTS must have directories that contain system commands owned by "root".

Vulnerability Discussion

Check

Verify the system commands directories are owned by "root" by using the following command:

$ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type d -exec stat -c "%n %U" '{}' \;

If any system commands directories are returned, this is a finding.

Fix

Ubuntu 22.04 LTS must have directories that contain system commands group-owned by "root".

Vulnerability Discussion

Check

Verify the system commands directories are group-owned by "root" by using the following command:

$ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type d -exec stat -c "%n %G" '{}' \;

If any system commands directories are returned that are not Set Group ID up on execution (SGID) files and owned by a privileged account, this is a finding.

Ubuntu 22.04 LTS must be configured so that the "journalctl" command is owned by "root".

Vulnerability Discussion

Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the operating system or platform. Additionally, Personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives.

The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.

Check

Verify that the "journalctl" command is owned by "root" by using the following command:

$ sudo find /usr/bin/journalctl -exec stat -c "%n %U" {} \;
/usr/bin/journalctl root

If "journalctl" is not owned by "root", this is a finding.

Fix

Configure "journalctl" to be owned by "root":

$ sudo chown root /usr/bin/journalctl

Ubuntu 22.04 LTS must be configured so that the "journalctl" command is group-owned by "root".

Vulnerability Discussion

Check

Verify that the "journalctl" command is group-owned by "root" by using the following command:

$ sudo find /usr/bin/journalctl -exec stat -c "%n %G" {} \;
/usr/bin/journalctl root

If "journalctl" is not group-owned by "root", this is a finding.

Fix

Configure "journalctl" to be group-owned by "root":

$ sudo chown :root /usr/bin/journalctl

Ubuntu 22.04 LTS must configure audit tools to be owned by "root".

Ubuntu 22.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources.

Vulnerability Discussion

Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection.

This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DOD or other government agencies.

There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components.

Check

Verify that all public directories have the public sticky bit set by using the following command:

$ sudo find / -type d -perm -002 ! -perm -1000

If any public directories are found missing the sticky bit, this is a finding.

Fix

Configure all public directories to have the sticky bit set to prevent unauthorized and unintended information transferred via shared system resources.

Set the sticky bit on all public directories using the following command, replacing "" with any directory path missing the sticky bit:

$ sudo chmod +t

Ubuntu 22.04 LTS must have an application firewall installed in order to control remote access methods.

Vulnerability Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best.

Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.

Ubuntu 22.04 LTS functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).

Check

Verify that the Uncomplicated Firewall is installed by using the following command:

$ dpkg -l | grep ufw
ii ufw 0.36.1-4ubuntu0.1 all program for managing a Netfilter firewall

If the "ufw" package is not installed, ask the system administrator if another application firewall is installed.

If no application firewall is installed, this is a finding.

Fix

Install the Uncomplicated Firewall by using the following command:

$ sudo apt-get install ufw

Check

Verify Ubuntu 22.04 LTS displays the Standard Mandatory DOD Notice and Consent Banner before granting access to the operating system via a graphical user logon with the command:

Note: If no graphical user interface is installed, this requirement is not applicable.

$ grep -i banner-message-text /etc/gdm3/greeter.dconf-defaults

banner-message-text="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

If the banner-message-text is missing, commented out, or does not match the Standard Mandatory DOD Notice and Consent Banner exactly, this is a finding.

Fix

Edit the "/etc/gdm3/greeter.dconf-defaults" file.

Set the "banner-message-text" line to contain the appropriate banner message text as shown below:

banner-message-text="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

Update GDM with the new configuration by using the following commands:

$ sudo dconf update

$ sudo systemctl restart gdm3

Ubuntu 22.04 LTS must retain a user's session lock until that user reestablishes access using established identification and authentication procedures.

Vulnerability Discussion

A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.

The session lock is implemented at the point where session activity can be determined.

Regardless of where the session lock is determined and implemented, once invoked, a session lock of Ubuntu 22.04 LTS must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.

Check

Verify Ubuntu 22.04 LTS has a graphical user interface session lock enabled by using the following command:

Note: If no graphical user interface is installed, this requirement is not applicable.

$ sudo gsettings get org.gnome.desktop.screensaver lock-enabled
true

If "lock-enabled" is not set to "true", is commented out, or is missing, this is a finding.

Fix

Configure Ubuntu 22.04 LTS to allow a user to lock the current graphical user interface session.

Set the "lock-enabled" setting to allow graphical user interface session locks by using the following command:

$ gsettings set org.gnome.desktop.screensaver lock-enabled true

Verify that Ubuntu 22.04 LTS monitors all remote access methods by using the following command:

$ grep -Er '^(auth\.\*,authpriv\.\*|daemon\.\*)' /etc/rsyslog.*
/etc/rsyslog.d/50-default.conf:auth.*,authpriv.* /var/log/secure
/etc/rsyslog.d/50-default.conf:daemon.* /var/log/messages

If "auth.*", "authpriv.*", or "daemon.*" are not configured to be logged in at least one of the config files, this is a finding.

Fix

Configure Ubuntu 22.04 LTS to monitor all remote access methods.

Add or modify the following line in the "/etc/rsyslog.d/50-default.conf" file:

auth.*,authpriv.* /var/log/secure
daemon.* /var/log/messages

Restart "rsyslog.service" for the changes to take effect by using the following command:

$ sudo systemctl restart rsyslog.service

Ubuntu 22.04 LTS must have the "auditd" package installed.

STIG ID: UBTU-22-653010 | SRG: SRG-OS-000037-GPOS-00015 | Severity: medium | CCI: CCI-000130,CCI-000131,CCI-000132,CCI-000133,CCI-000134,CCI-000135,CCI-000154,CCI-000158,CCI-000169,CCI-000172,CCI-003938,CCI-001875,CCI-001876,CCI-001877,CCI-001878,CCI-001879,CCI-001880,CCI-001881,CCI-001882,CCI-001914,CCI-001814 | Vulnerability Id: V-260590 |

Vulnerability Discussion

Without establishing the when, where, type, source, and outcome of events that occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.

Successful incident response and auditing relies on timely, accurate system information and analysis in order to allow the organization to identify and respond to potential incidents in a proficient manner. If the operating system does not provide the ability to centrally review the operating system logs, forensic analysis is negatively impacted.

Associating event types with detected events in Ubuntu 22.04 LTS audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating system.

Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00020, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000062-GPOS-00031, SRG-OS-000122-GPOS-00063, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000365-GPOS-00152, SRG-OS-000475-GPOS-00220

Check

Verify the "auditd" package is installed by using the following command:

$ dpkg -l | grep auditd
ii libauditd 1:3.0.7-1build1 amd64 User space tools for security auditing

If the "auditd" package is not installed, this is a finding.

Fix

Install the "auditd" package by using the following command:

$ sudo apt-get install auditd

Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.

Ubuntu 22.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users.

Vulnerability Discussion

If audit information were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.

To ensure the veracity of audit information, the operating system must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods, which will depend upon system architecture and design.

Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.

Check

Verify that the audit log directory has a mode of "750" or less permissive.

Determine where the audit logs are stored by using the following command:

$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, determine if the directory has a mode of "750" or less by using the following command:

$ sudo stat -c "%n %a" /var/log/audit
/var/log/audit 750

If the audit log directory has a mode more permissive than "750", this is a finding.

Fix

Configure the audit log directory to have a mode of "750" or less permissive.

Using the path of the directory containing the audit logs, configure the audit log directory to have a mode of "750" or less permissive by using the following command:

$ sudo chmod -R g-w,o-rwx /var/log/audit

Ubuntu 22.04 LTS must be configured so that audit configuration files are not write-accessible by unauthorized users.

Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls.

Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the init_module and finit_module system calls.

Ubuntu 22.04 LTS must generate audit records for all events that affect the systemd journal files.