Skip to content

0018-hosts – Hosts File Modified


Rule ID

  • 0018-hosts

Category

  • System

Level

  • Warn

Compatible Versions

  • Linux

Description

  • Monitors whether the host hosts file has been modified.

Scan Frequency

  • Disable

Rationale

  • The hosts file is a file in Linux systems responsible for quickly resolving IP addresses to domain names. It is stored in ASCII format under the /etc directory with the filename hosts. The hosts file contains mappings between IP addresses and hostnames, as well as aliases for hostnames. In the absence of a domain name server, all network programs on the system query this file to resolve the IP address corresponding to a hostname; otherwise, the DNS service is used. Commonly used domain names and IP address mappings can be added to the hosts file for fast and convenient access. Malicious modification of the hosts file can cause service unavailability.

Risk Items

  • Service Unavailability

Audit Method

  • Verify whether the host /etc/hosts file has been illegally modified. You can run the following command:
ls -l /etc/hosts

Remediation

  • If the host /etc/hosts file has been illegally modified, carefully inspect the host environment for signs of intrusion and change the host user password.

Impact

  • None

Default Value

  • None

References

  • None

CIS Controls

  • None

Feedback

Is this page helpful?