Title

Successful and unsuccessful logins and logouts must be logged. (Cat II impact)

Discussion

Monitoring and recording successful and unsuccessful logins assist in tracking unauthorized access to the system. Without this logging, the ability to track unauthorized activity to specific user accounts may be diminished.

Check Content

Determine if successful/unsuccessful logons are being logged. # tail -n 100 /var/adm/SYSLOG Determine if successful/unsuccessful logons are configured to be logged. # grep SYSLOG /etc/default/login If "SYSLOG" is not set to ALL, this is a finding.

Fix Text

Verify that login logs are handled correctly in the /etc/default/login file.

Additional Identifiers

Rule ID:

Vulnerability ID: V-765

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.