Check: GEN002870
HP-UX 11.31 STIG:
GEN002870
(in versions v1 r19 through v1 r13)
Title
The system must be configured to send audit records to a remote audit server. (Cat III impact)
Discussion
Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host.
Check Content
The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. The vendor (HP) recommends that a script be written to implement a long term strategy for data storage and pass it to the audomon daemon using the "-X <command>" option. <command> is executed each time audomon switches the audit trail. The means used to implement audit log transfer to a remote system will be site specific and therefore always require a manual review. ASK the SA if audomon is configured per the vendor's (HP) guidance to implement a long term, remote data storage strategy.
Fix Text
The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. Create a <command> script to implement the vendor-recommended, long term data storage strategy and pass it to the audomon daemon using the "-X <command>" option. The <command> must be executed each time audomon switches the audit trail. A manual review of the <command> script is required.
Additional Identifiers
Rule ID: SV-38413r1_rule
Vulnerability ID: V-24357
Group Title: GEN002870
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000136 |
The organization centrally manages the content of audit records generated by organization-defined information system components. |
Controls
Number | Title |
---|---|
No controls are assigned to this check |