Title

Auditing must be implemented. (Cat II impact)

Discussion

Without auditing, individual system accesses cannot be tracked and malicious activity cannot be detected and traced back to an individual account.

Check Content

Determine the type of zone that you are currently securing. # zonename If the output of "zonename" is "global", then auditing must be enabled. Determine if auditing is enabled. # ps -ef |grep auditd If the auditd process is not found, this is a finding. If the output of "zonename" is not "global", then the "perzone" policy must be determined. # auditconfig --getpolicy audit policies = cnt,perzone If "perzone" is not listed then this requirement is not applicable. If "perzone" is listed then determine if auditing is enabled. # ps -ef |grep auditd If the auditd process is not found, this is a finding.

Fix Text

Use /etc/security/bsmconv to enable auditing on the system.

Additional Identifiers

Rule ID: SV-227715r603266_rule

Vulnerability ID: V-227715

Group Title: SRG-OS-000062

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.