The Red Hat Enterprise Linux operating system must be configured to use the au-remote plugin.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-81015	RHEL-07-030200	SV-95727r1_rule		Medium

Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Without the configuration of the "au-remote" plugin, the audisp-remote daemon will not off-load the logs from the system being audited. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

STIG	Date
Red Hat Enterprise Linux 7 Security Technical Implementation Guide	2018-11-28

Details

Check Text ( C-80729r1_chk )
Verify the "au-remote" plugin is active on the system: # grep "active" /etc/audisp/plugins.d/au-remote.conf active = yes If the "active" setting is not set to "yes", or the line is commented out, this is a finding.

Fix Text (F-87849r2_fix)
Edit the /etc/audisp/plugins.d/au-remote.conf file and change the value of "active" to "yes". The audit daemon must be restarted for changes to take effect: # service auditd restart