Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-38578 | RHEL-06-000201 | SV-50379r1_rule | Low |
Description |
---|
The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes. |
STIG | Date |
---|---|
Red Hat Enterprise Linux 6 Security Technical Implementation Guide | 2013-06-03 |
Check Text ( C-46136r1_chk ) |
---|
To verify that auditing is configured for system administrator actions, run the following command: # auditctl -l | grep "watch=/etc/sudoers" If there is no output, this is a finding. |
Fix Text (F-43526r1_fix) |
---|
At a minimum, the audit system should collect administrator actions for all users and root. Add the following to "/etc/audit/audit.rules": -w /etc/sudoers -p wa -k actions |