The audit system must be configured to audit changes to the "/etc/sudoers" file.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
RHEL-06-000201	RHEL-06-000201	RHEL-06-000201_rule		Low

Description
The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.

STIG	Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide	2013-02-05

Details

Check Text ( C-RHEL-06-000201_chk )
To verify that auditing is configured for system administrator actions, run the following command: # auditctl -l | grep "watch=/etc/sudoers" If there is no output, this is a finding.

Fix Text (F-RHEL-06-000201_fix)
At a minimum the audit system should collect administrator actions for all users and root. Add the following to "/etc/audit/audit.rules": -w /etc/sudoers -p wa -k actions