Title

The audit-audispd-plugins must be installed on the SUSE operating system. (Cat II impact)

Discussion

The audit-audispd-plugins must be installed on the SUSE operating system.

Check Content

Verify that the "audit-audispd-plugins" package is installed on the SUSE operating system. Check that the "audit-audispd-plugins" package is installed on the SUSE operating system with the following command: > zypper info audit-audispd-plugins | grep Installed If the "audit-audispd-plugins" package is not installed, this is a finding. Verify the "au-remote" plugin is enabled with the following command: > sudo grep -i active /etc/audisp/plugins.d/au-remote.conf active = yes If "active" is missing, commented out, or is not set to "yes", this is a finding.

Fix Text

Install the "audit-audispd-plugins" package on the SUSE operating system by running the following command: > sudo zypper install audit-audispd-plugins In "/etc/audisp/plugins.d/au-remote.conf", change the value of "active" to "yes", or add "active = yes" if no such setting exists in the file.

Additional Identifiers

Rule ID: SV-234966r877390_rule

Vulnerability ID: V-234966

Group Title: SRG-OS-000342-GPOS-00133

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.