UCF STIG Viewer Logo

Security auditing must be configured.


Overview

Finding ID Version Rule ID IA Controls Severity
V-25269 OSX00145 M6 SV-38521r1_rule ECAR-1 ECAR-2 ECAR-3 Medium
Description
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises or attacks that have occurred, has begun, or is about to begin. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Without an audit trail providing information as to what occurred and if it was successful or unsuccessful, it is difficult to analyze a series of events to determine the steps used by an attacker to compromise a system or network, or what exactly happened that led to a Denial of Service. Collecting data such as the successful and unsuccessful events is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
STIG Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft 2013-01-10

Details

Check Text ( C-37734r1_chk )
Open a terminal session and enter the following command view the audit flags.

more /etc/security/audit_control file.

Review the entries and ensure the line includes the following: flags: lo,ad,-all,-fr,fd,fm,^-fa,^-fc,^-cl.
If the file does not contain the appropriate flags, this is a finding.
Fix Text (F-32978r1_fix)
Open a terminal session and edit the /etc/security/audit_control file.
Find the line beginning with "flags".
Replace that line with the following: flags:lo,ad,-all,-fr,fd,fm,^-fa,^-fc,^-cl.
Save the file.