Title

The system must log authentication informational data. (Cat II impact)

Discussion

Monitoring and recording successful and unsuccessful logins assists in tracking unauthorized access to the system.

Check Content

Check /etc/syslog.conf and verify the auth facility is logging both the notice and info (NOTE that auth.info includes auth.notice and the auth.debug includes both auth.info and auth.notice) level messages by: # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | egrep -i "auth.info|auth.debug|auth.\*|\*.info|\*.debug" If auth.* is not found, or auth.notice or auth.debug or *.info and *.debug are not found, this is a finding.

Fix Text

Edit /etc/syslog.conf and add local log destinations for auth.*, auth.debug, auth.info, *.debug or *.info. NOTE: In general and though not required, it is always advisable to explicitly declare auth.info or auth.debug entries rather than use the wildcard notation method.

Additional Identifiers

Rule ID: SV-35062r1_rule

Vulnerability ID: V-12004

Group Title: GEN003660

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.