Check: GEN002753
SUSE Linux Enterprise Server v11 for System z STIG:
GEN002753
(in versions v1 r12 through v1 r9)
Title
The audit system must be configured to audit account termination. (Cat III impact)
Discussion
If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.
Check Content
Determine if execution of the userdel and groupdel executable are audited. # auditctl -l | egrep '(userdel|groupdel)' If either userdel or groupdel are not listed with a permissions filter of at least 'x', this is a finding.
Fix Text
Configure execute auditing of the userdel and groupdel executables. Add the following to the audit.rules file: -w /usr/sbin/userdel -p x -w /usr/sbin/groupdel -p x Restart the auditd service. # rcauditd restart OR # service auditd restart
Additional Identifiers
Rule ID: SV-45323r1_rule
Vulnerability ID: V-22382
Group Title: GEN002753
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001405 |
The information system automatically audits account removal actions. |
Controls
Number | Title |
---|---|
AC-2 (4) |
Automated Audit Actions |