mediumauditunverified
Audit modification of /etc/nsswitch.conf (RHEL 10)
audit-nsswitch-rhel10 · RHEL ≥ 10 · 1 impl
Description
On RHEL 10 record write/attribute changes to /etc/nsswitch.conf via the syscall audit form (-S all -F path=/etc/nsswitch.conf -F perm=wa).
Rationale
nsswitch.conf controls name-service resolution order; tampering can redirect authentication or name lookups. Auditing provides attribution.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F arch=b64 -S all -F path=/etc/nsswitch.conf -F perm=wa -F key=identity
Remediatemanual
- note:
- Add -S all -F path=/etc/nsswitch.conf -F perm=wa -F key=identity to /etc/audit/rules.d/ and augenrules --load.
Framework references
CIS
rhel10 6.3.3.16
NIST 800-53
AU-12
#audit#identity#nsswitch#cis