Check: AOSX-09-002100
Apple OS X 10.9 Workstation STIG:
AOSX-09-002100
(in version v1 r2)
Title
The operating system must generate audit records when successful/unsuccessful attempts to access privileges occur. (Cat II impact)
Discussion
Frequently, an attacker that successfully gains access to a system has only gained access to an account with limited privileges, such as a guest account or a service account. The attacker must attempt to change to another user account with normal or elevated privileges in order to proceed. Auditing successful and unsuccessful attempts to elevate privileges mitigates this risk.
Check Content
The options to configure the audit daemon are located in the /etc/security/audit_control file. To view the current settings, run the following command: sudo grep ^flags /etc/security/audit_control If the 'lo', 'ad', and 'aa' options are not set, this is a finding.
Fix Text
To set the audit flags to the recommended setting, run the following command to add the flags 'lo', 'ad', and 'aa' all at once: sudo sed -i.bak '/^flags/ s/$/,lo,ad,aa/' /etc/security/audit_control; sudo audit -s A text editor may also be used to implement the required update to the /etc/security/audit_control file.
Additional Identifiers
Rule ID: SV-72927r1_rule
Vulnerability ID: V-58497
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000172 |
The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3. |
Controls
Number | Title |
---|---|
AU-12 |
Audit Generation |