Check: RHEL-07-030610
RHEL 7 STIG:
RHEL-07-030610
(in versions v3 r15 through v1 r1)
Title
The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account access events. (Cat II impact)
Discussion
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218
Check Content
Verify the operating system generates audit records when unsuccessful account access events occur. Check the file system rule in "/etc/audit/audit.rules" with the following commands: # grep -i /var/run/faillock /etc/audit/audit.rules -w /var/run/faillock -p wa -k logins If the command does not return any output, this is a finding.
Fix Text
Configure the operating system to generate audit records when unsuccessful account access events occur. Add or update the following rule in "/etc/audit/rules.d/audit.rules": -w /var/run/faillock -p wa -k logins The audit daemon must be restarted for the changes to take effect.
Additional Identifiers
Rule ID: SV-204540r958846_rule
Vulnerability ID: V-204540
Group Title: SRG-OS-000392-GPOS-00172
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000126 |
Specify the organization-defined event types (subset of the event types defined in AU-2a) along with the frequency of (or situation requiring logging for each identified event type. |
| CCI-000172 |
Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3. |
| CCI-002884 |
Log organization-defined audit events for nonlocal maintenance and diagnostic sessions. |