Check: OSX8-00-00030
Apple OSX 10.8 STIG:
OSX8-00-00030
(in version v1 r2)
Title
The operating system must employ automated mechanisms to facilitate the monitoring and control of remote access methods. (Cat II impact)
Discussion
Remote network access is accomplished by leveraging common communication protocols and establishing a remote connection. Remote access is any access to an organizational information system by a user (or an information system) communicating through an external, non-organization-controlled network (e.g., the Internet). Examples of remote access methods include dial-up, broadband, and wireless. Automated monitoring of remote access sessions allows organizations to audit user activities on a variety of information system components (e.g., servers, workstations, notebook/laptop computers) and to ensure compliance with remote access policy.
Check Content
To check to make sure the audit daemon is configured to log all login events, both local and remote, run the following command: sudo grep ^flags /etc/security/audit_control | sed 's/flags://' | tr "," "\n" | grep lo The flag "lo" should be included in the list of flags set. If it is not, this is a finding.
Fix Text
To edit the configuration of the audit daemon flags, open the /etc/security/audit_control file and make sure "lo" is listed in the "flags:" parameter. To programmatically do this, run the following command: sudo sed -i.bak '/^flags/ s/$/,lo/' /etc/security/audit_control; sudo audit -s
Additional Identifiers
Rule ID: SV-65689r1_rule
Vulnerability ID: V-51479
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000067 |
The information system monitors remote access methods. |
Controls
Number | Title |
---|---|
AC-17 (1) |
Automated Monitoring / Control |