Check: GEN002750
HP-UX 11.31 STIG:
GEN002750
(in versions v1 r19 through v1 r13)
Title
The audit system must be configured to audit account creation. (Cat III impact)
Discussion
If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises, and damages incurred during a system compromise.
Check Content
Check the auditing configuration of the system. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep admin If no results are returned, the system is not configured to audit administrative actions, this is a finding.
Fix Text
Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.
Additional Identifiers
Rule ID: SV-29670r1_rule
Vulnerability ID: V-22376
Group Title: GEN002750
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000018 |
The information system automatically audits account creation actions. |
Controls
Number | Title |
---|---|
AC-2 (4) |
Automated Audit Actions |