Check: RHEL-09-653060
RHEL 9 STIG:
RHEL-09-653060
(in versions v1 r3 through v1 r1)
Title
RHEL 9 must label all offloaded audit logs before sending them to the central log server. (Cat II impact)
Discussion
Enriched logging is needed to determine who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult. When audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system. Satisfies: SRG-OS-000039-GPOS-00017, SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Check Content
Verify that RHEL 9 Audit Daemon is configured to label all offloaded audit logs, with the following command: $ sudo grep name_format /etc/audit/auditd.conf name_format = hostname If the "name_format" option is not "hostname", "fqd", or "numeric", or the line is commented out, this is a finding.
Fix Text
Edit the /etc/audit/auditd.conf file and add or update the "name_format" option: name_format = hostname The audit daemon must be restarted for changes to take effect.
Additional Identifiers
Rule ID: SV-258161r926470_rule
Vulnerability ID: V-258161
Group Title: SRG-OS-000039-GPOS-00017
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000132 |
The information system generates audit records containing information that establishes where the event occurred. |
| CCI-001851 |
The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited. |