All privileged function executions must be audited.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-72095 | RHEL-07-030360 | SV-86719r5_rule | Medium |
| Description |
|---|
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat. |
| STIG | Date |
|---|---|
| Red Hat Enterprise Linux 7 Security Technical Implementation Guide | 2017-12-14 |
Details
| Check Text ( C-72327r5_chk ) |
|---|
| Verify the operating system audits the execution of privileged functions. To find relevant setuid and setgid programs, use the following command once for each local partition [PART]: # find [PART] -xdev -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null Run the following command to verify entries in the audit rules for all programs found with the previous command: # grep -i " -a always,exit -F path=" All "setuid" and "setgid" files on the system must have a corresponding audit rule, or must have an audit rule for the (sub) directory that contains the "setuid"/"setgid" file. If all "setuid"/"setgid" files on the system do not have audit rule coverage, this is a finding. |
| Fix Text (F-78447r7_fix) |
|---|
| Configure the operating system to audit the execution of privileged functions. To find the relevant "setuid"/"setgid" programs, run the following command for each local partition [PART]: # find [PART] -xdev -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null For each "setuid"/"setgid" program on the system, which is not covered by an audit rule for a (sub) directory (such as "/usr/sbin"), add a line of the following form to "/etc/audit/rules.d/audit.rules", where -a always,exit -F path= |