UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The audit system must be configured to audit changes to the /etc/sudoers file.


Overview

Finding ID Version Rule ID IA Controls Severity
V-38578 RHEL-06-000201 SV-50379r2_rule Low
Description
The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2017-04-28

Details

Check Text ( None )
None
Fix Text (F-43526r1_fix)
At a minimum, the audit system should collect administrator actions for all users and root. Add the following to "/etc/audit/audit.rules":

-w /etc/sudoers -p wa -k actions