File size: 1,074 Bytes
08c964e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 | #!/usr/bin/python
#coding: utf-8
import os, re, public
_title = '审核日志永久保存'
_version = 1.0 # 版本
_ps = "检查审核日志满了后是否自动删除" # 描述
_level = 0 # 风险级别： 1.提示(低) 2.警告(中) 3.危险(高)
_date = '2023-03-15' # 最后更新时间
_ignore = os.path.exists("data/warning/ignore/sw_audit_log_keep.pl")
_tips = [
"在【/etc/audit/auditd.conf】中max_log_file_action将ROTATE改为KEEP_LOGS",
"重启auditd服务systemctl restart auditd"
]
_help = ''
def check_run():
cfile = '/etc/audit/auditd.conf'
if not os.path.exists(cfile):
return False, '有风险，未安装auditd审计工具'
result = public.ReadFile(cfile)
# 默认是rotate，日志满了后循环日志，keep_logs会保留旧日志
rep = 'max_log_file_action\s*=\s(.*)'
tmp = re.search(rep, result)
if tmp:
if 'keep_logs'.lower() == tmp.group(1).lower():
return True, '无风险'
return False, '当前max_log_file_action值为{}，应当为KEEP_LOGS'.format(tmp.group(1))
|