sunhux
asked on
if grub.conf/cfg & audit.conf/rules are missing, are they compliant to CIS benchmarks?
CIS benchmarks for Ubuntu & Debian list a number of settings that must
be found in grub.conf/.cfg & audit.conf/.rules for them to be deemed
compliant to CIS/hardened settings.
What if these files are not found in the Ubuntu/Debian servers? Does
this mean they're compliant (as good as hardened) or we have to
specifically create these files & insert the lines (eg: grub.cfg should
have a line 'set superusers="<username>" ' while audit.rules
should have "-e 2" at the end of the file) ?
be found in grub.conf/.cfg & audit.conf/.rules for them to be deemed
compliant to CIS/hardened settings.
What if these files are not found in the Ubuntu/Debian servers? Does
this mean they're compliant (as good as hardened) or we have to
specifically create these files & insert the lines (eg: grub.cfg should
have a line 'set superusers="<username>" ' while audit.rules
should have "-e 2" at the end of the file) ?
What you're asking will require someone to go through your system to determine compliance, if compliance is really that important.
This will likely take many hours, beginning with what compliance might mean, at both a machine level, then in every container running some sort of microservice.
This is a long road. Far past what can be answered in a simple EE question.
You'll either go through this process yourself or hire someone who can go through the process.
Be sure you also work out your continuous verification process (most people completely miss this step).
You'll determine the exact set of continuous verification steps to be done, along with the testing interval, as compliance must be continually verified.
This will likely take many hours, beginning with what compliance might mean, at both a machine level, then in every container running some sort of microservice.
This is a long road. Far past what can be answered in a simple EE question.
You'll either go through this process yourself or hire someone who can go through the process.
Be sure you also work out your continuous verification process (most people completely miss this step).
You'll determine the exact set of continuous verification steps to be done, along with the testing interval, as compliance must be continually verified.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER