Title

The audit system must be configured to audit changes to the /etc/sudoers file. (Cat III impact)

Discussion

The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.

Check Content

To verify that auditing is configured for system administrator actions, run the following command: $ sudo grep -w "/etc/sudoers" /etc/audit/audit.rules If the system is configured to watch for changes to its sudoers configuration, a line should be returned (including "-p wa" indicating permissions that are watched). If there is no output, this is a finding.

Fix Text

At a minimum, the audit system should collect administrator actions for all users and root. Add the following to "/etc/audit/audit.rules": -w /etc/sudoers -p wa -k actions

Additional Identifiers

Rule ID: SV-217979r603264_rule

Vulnerability ID: V-217979

Group Title: SRG-OS-000064

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.