0008-hostname - Hostname Modified¶

Rule ID¶

• 0008-hostname

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

• Windows

Description¶

• Monitors for changes to the hostname.

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• The hostname in Linux is a kernel variable that can be viewed using the hostname command, or by directly checking /proc/sys/kernel/hostname. If the hostname is set incorrectly, it may cause online services or applications to be inaccessible or even refuse to provide service. If the hostname is maliciously modified, it can affect the normal operation of the host system.

Risk Items¶

• Application Denial of Service

Audit Method¶

• Verify whether the hostname has been illegally modified. You can execute the following command to verify:

hostname

Remediation¶

• If the hostname has been illegally modified, use hostnamectl set-hostname to restore it. Be sure to carefully check the host environment for any signs of compromise, and change the host user password.

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None