Title

The HP-UX AUDOMON_ARGS attribute must be explicitly initialized. (Cat II impact)

Discussion

The minimal set of auditing requirements necessary to collect useful forensics data and provide user help when violations are detected must be configured.

Check Content

Check the /etc/rc.config.d/auditing file AUDOMON_ARGS settings: # cat /etc/rc.config.d/auditing | tr “\011” “ “ | tr -s “ “ | sed -e 's/^[ \t]*//' grep -v “#” The above command should return a single line with the following information: AUDOMON_ARGS=“-p 20, -t 1, -w 90” If “p”, “t”, or “w” flags are not set to “20”, “1”, and “90”, respectively, this is a finding.

Fix Text

Edit the /etc/rc.config.d/auditing file and insert the following line: AUDOMON_ARGS=“-p 20, -t 1, -w 90” Restart auditing: # /sbin/init.d/auditing stop # /sbin/init.d/auditing start

Additional Identifiers

Rule ID: SV-38429r2_rule

Vulnerability ID: V-4290

Group Title: GEN000000-HPUX0040

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.