Check: GEN002751
HP-UX 11.31 STIG:
GEN002751
(in versions v1 r19 through v1 r13)
Title
The audit system must be configured to audit account modification. (Cat III impact)
Discussion
If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.
Check Content
Check the auditing configuration of the system. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep admin If no results are returned, the system is not configured to audit administrative actions, this is a finding.
Fix Text
Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.
Additional Identifiers
Rule ID: SV-29675r1_rule
Vulnerability ID: V-22377
Group Title: GEN002751
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001403 |
The information system automatically audits account modification actions. |
Controls
Number | Title |
---|---|
AC-2 (4) |
Automated Audit Actions |