UCF STIG Viewer Logo

The operating system must generate audit records when successful/unsuccessful logon attempts occur.


Overview

Finding ID Version Rule ID IA Controls Severity
V-59589 AOSX-10-000200 SV-74019r1_rule Medium
Description
An attacker might attempt to log in as an authorized user, through stolen credentials, unpatched exploits, or brute force attempts to guess a valid username and password. If a user is attempting to log in to a system at an unusual time, or if there are many failed attempts, there is a possibility that the system is the target of an attack. Auditing logon events mitigates this risk by recording all logon attempts, successful and unsuccessful, to the system.
STIG Date
Apple OS X 10.10 (Yosemite) Workstation Security Technical Implementation Guide 2017-04-06

Details

Check Text ( C-60359r1_chk )
In order to view the currently configured flags for the audit daemon, run the following command:

sudo grep ^flags /etc/security/audit_control

Logon events are logged by way of the 'aa' flag. If 'aa' is not listed in the result of the check, this is a finding.
Fix Text (F-64999r1_fix)
To make sure the appropriate flags are enabled for auditing, run the following command:

sudo sed -i.bak '/^flags/ s/$/,aa/' /etc/security/audit_control; sudo audit -s

A text editor may also be used to implement the required updates to the /etc/security/audit_control file.