mediumauditverified ✓✓rollback-safe
Audit privileged execution of /usr/lib/openssh/ssh-keysign (Ubuntu)
audit-priv-ssh-keysign · UBUNTU ≥ 22 · 1 impl
Description
All uses of the /usr/lib/openssh/ssh-keysign command must generate an audit record so that ssh-keysign use can be traced to an individual.
Rationale
Auditing execution of privileged commands allows detection of misuse and supports forensic investigation of privilege escalation.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh
Remediateaudit_rule_set
- rule:
- -a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh
- persist_file:
- /etc/audit/rules.d/50-priv-ssh-keysign.rules
Framework references
STIG
V-270783 / UBTU-24-900120V-260621 / UBTU-22-654095
NIST 800-53
AU-2AU-12
Live verification
ubuntu22:checkubuntu24:checkubuntu24:remediate
#audit#auditd#privileged