The system must log informational authentication data.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-12004	GEN003660	SV-64229r2_rule	ECAR-1 ECAR-2 ECAR-3	Medium

Description
Monitoring and recording successful and unsuccessful logins assists in tracking unauthorized access to the system.

STIG	Date
Oracle Linux 5 Security Technical Implementation Guide	2015-06-05

Details

Check Text ( C-52683r2_chk )
Depending on what system is used for log processing either /etc/syslog.conf or /etc/rsyslog.conf will be the logging configuration file. Check /etc/syslog.conf or /etc/rsyslog.conf and verify the authpriv facility is logging both the "notice" and "info" priority messages. Procedure: For a given action all messages of a higher severity or "priority" are logged. The three lowest priorities in ascending order are "debug", "info" and "notice". A priority of "info" will include "notice". A priority of "debug" includes both "info" and "notice". Enter/Input for syslog: # grep "authpriv.debug" /etc/syslog.conf # grep "authpriv.info" /etc/syslog.conf # grep "authpriv\.\" /etc/syslog.conf Enter/Input for rsyslog: # grep "authpriv.debug" /etc/rsyslog.conf # grep "authpriv.info" /etc/rsyslog.conf # grep "authpriv\.\" /etc/rsyslog.conf If an "authpriv.*", "authpriv.debug", or "authpriv.info" entry is not found, this is a finding.

Check Text ( C-52683r2_chk )

Depending on what system is used for log processing either /etc/syslog.conf or /etc/rsyslog.conf will be the logging configuration file.

Check /etc/syslog.conf or /etc/rsyslog.conf and verify the authpriv facility is logging both the "notice" and "info" priority messages.

Procedure:

For a given action all messages of a higher severity or "priority" are logged. The three lowest priorities in ascending order are "debug", "info" and "notice". A priority of "info" will include "notice". A priority of "debug" includes both "info" and "notice".

Enter/Input for syslog:

# grep "authpriv.debug" /etc/syslog.conf
# grep "authpriv.info" /etc/syslog.conf
# grep "authpriv\.\*" /etc/syslog.conf

Enter/Input for rsyslog:

# grep "authpriv.debug" /etc/rsyslog.conf
# grep "authpriv.info" /etc/rsyslog.conf
# grep "authpriv\.\*" /etc/rsyslog.conf

If an "authpriv.*", "authpriv.debug", or "authpriv.info" entry is not found, this is a finding.

Fix Text (F-54837r2_fix)
Edit /etc/syslog.conf or /etc/rsyslog.conf and add local log destinations for "authpriv.*", "authpriv.debug" or "authpriv.info".