Check: GEN002752
HP-UX 11.31 STIG:
GEN002752
(in versions v1 r19 through v1 r13)
Title
The audit system must be configured to audit account disabling. (Cat III impact)
Discussion
If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.
Check Content
Check the auditing configuration of the system. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep admin If no results are returned, the system is not configured to audit administrative actions, this is a finding.
Fix Text
Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.
Additional Identifiers
Rule ID: SV-29676r1_rule
Vulnerability ID: V-22378
Group Title: GEN002752
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001404 |
The information system automatically audits account disabling actions. |
Controls
Number | Title |
---|---|
AC-2 (4) |
Automated Audit Actions |