mediumauditverified ✓✓rollback-safe
Audit access to /usr/sbin/fdisk (Ubuntu)
audit-watch-fdisk · UBUNTU ≥ 22 · 1 impl
Description
Modifications to /usr/sbin/fdisk must generate an audit record so that partition-table changes can be traced to an individual.
Rationale
Auditing this path supports detection of unauthorized changes and forensic reconstruction of events.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -w /usr/sbin/fdisk -p x -k fdisk
Remediateaudit_rule_set
- rule:
- -w /usr/sbin/fdisk -p x -k fdisk
- persist_file:
- /etc/audit/rules.d/50-watch-fdisk.rules
Framework references
STIG
V-270815 / UBTU-24-900750V-260611 / UBTU-22-654045
NIST 800-53
AU-2AU-12
Live verification
ubuntu22:checkubuntu24:checkubuntu24:remediate
#audit#auditd#watch