The operating system must generate audit records when successful/unsuccessful logon attempts occur.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58313	AOSX-09-000200	SV-72743r1_rule		Medium

Description
An attacker might attempt to log in as an authorized user, through stolen credentials, unpatched exploits, or brute force attempts to guess a valid username and password. If a user is attempting to log in to a system at an unusual time, or if there are many failed attempts, there is a possibility that the system is the target of an attack. Auditing logon events mitigates this risk by recording all logon attempts, successful and unsuccessful, to the system.

Description

An attacker might attempt to log in as an authorized user, through stolen credentials, unpatched exploits, or brute force attempts to guess a valid username and password. If a user is attempting to log in to a system at an unusual time, or if there are many failed attempts, there is a possibility that the system is the target of an attack. Auditing logon events mitigates this risk by recording all logon attempts, successful and unsuccessful, to the system.

STIG	Date
Apple OS X 10.9 (Mavericks) Workstation Security Technical Implementation Guide	2017-01-05

Details

Check Text ( C-59139r1_chk )
In order to view the currently configured flags for the audit daemon, run the following command: sudo grep ^flags /etc/security/audit_control Logon events are logged by way of the 'aa' flag. If 'aa' is not listed in the result of the check, this is a finding.

Fix Text (F-63629r1_fix)
To make sure the appropriate flags are enabled for auditing, run the following command: sudo sed -i.bak '/^flags/ s/$/,aa/' /etc/security/audit_control; sudo audit -s A text editor may also be used to implement the required update to the /etc/security/audit_control file.