Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-29238 | GEN002720-4 | SV-37654r2_rule | ECAR-1 ECAR-2 ECAR-3 | Medium |
Description |
---|
If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. |
STIG | Date |
---|---|
Red Hat Enterprise Linux 5 Security Technical Implementation Guide | 2014-01-09 |
Check Text ( C-36844r2_chk ) |
---|
Verify auditd is configured to audit failed file access attempts. There must be an audit rule for each of the access syscalls logging all failed accesses (-F success=0) or there must both an "-F exit=-EPERM" and "-F exit=-EACCES" for each access syscall. Procedure: # cat /etc/audit/audit.rules | grep -e "-a exit,always" | grep -e "-S truncate" | grep -e "-F success=0" # cat /etc/audit/audit.rules | grep -e "-a exit,always" | grep -e "-S truncate" | grep -e "-F exit=-EPERM" # cat /etc/audit/audit.rules | grep -e "-a exit,always" | grep -e "-S truncate" | grep -e "-F exit=-EACCES" If an "-S truncate" audit rule with "-F success" does not exist and no separate rules containing "-F exit=-EPERM" and "-F exit=-EACCES" for "truncate" exist, then this is a finding. |
Fix Text (F-31681r1_fix) |
---|
Edit the audit.rules file and add the following line(s) to enable auditing of failed attempts to access files and programs: either: -a exit,always -F arch= or both: -a exit,always -F arch= -a exit,always -F arch= Restart the auditd service. # service auditd restart |