From 2ca8c1ca065186e18725fb533ebfdb117a74def5 Mon Sep 17 00:00:00 2001
From: Mark Bolwell <mark.bollyuk@gmail.com>
Date: Mon, 11 Nov 2024 14:58:09 +0000
Subject: [PATCH] updated v2 for 5.2.3 as per issue #39

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
---
 section_5/cis_5.2/cis_5.2.3.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/section_5/cis_5.2/cis_5.2.3.yml b/section_5/cis_5.2/cis_5.2.3.yml
index 08b49fa..b643bf9 100644
--- a/section_5/cis_5.2/cis_5.2.3.yml
+++ b/section_5/cis_5.2/cis_5.2.3.yml
@@ -5,11 +5,11 @@
 command:
   log_sudoers_d:
     title: 5.2.3 | Ensure sudo log file exists | sudoers.d
-    exec: "grep -Ec '^Defaults logfile=/var/log/*.log' /etc/sudoers /etc/sudoers.d/.*/"
+    exec: 'grep -Ec "^Defaults.*logfile=(\"|)/var/log/.*\.log(\"|)" /etc/sudoers /etc/sudoers.d/*'
     exit-status:
       lt: 3
     stdout:
-    - '/[1:99]/'
+    - '/.*:[1:99]/'
     meta:
       server: 1
       workstation: 1