Title

Security auditing must be configured. (Cat II impact)

Discussion

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises or attacks that have occurred, has begun, or is about to begin. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Without an audit trail providing information as to what occurred and if it was successful or unsuccessful, it is difficult to analyze a series of events to determine the steps used by an attacker to compromise a system or network, or what exactly happened that led to a Denial of Service. Collecting data such as the successful and unsuccessful events is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

Check Content

Open a terminal session and enter the following command view the audit flags. more /etc/security/audit_control file. Review the entries and ensure the line includes the following: flags: lo,ad,-all,-fr,fd,fm,^-fa,^-fc,^-cl. If the file does not contain the appropriate flags, this is a finding.

Fix Text

Open a terminal session and edit the /etc/security/audit_control file. Find the line beginning with "flags". Replace that line with the following: flags:lo,ad,-all,-fr,fd,fm,^-fa,^-fc,^-cl. Save the file.

Additional Identifiers

Rule ID: SV-38521r1_rule

Vulnerability ID: V-25269

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.