The audit-audispd-plugins must be installed on the SUSE operating system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-217197	SLES-12-020070	SV-217197r603262_rule		Medium

Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.

STIG	Date
SLES 12 Security Technical Implementation Guide	2020-12-04

Details

Check Text ( C-18425r369747_chk )
Verify that the "audit-audispd-plugins" package is installed on the SUSE operating system. Check that the "audit-audispd-plugins" package is installed on the SUSE operating system with the following command: # zypper se audit-audispd-plugins If the "audit-audispd-plugins" package is not installed, this is a finding. Verify the "au-remote" plugin is enabled with the following command: # grep -i active /etc/audisp/plugins.d/au-remote.conf active = yes If "active" is missing, commented out, or is not set to "yes", this is a finding.

Check Text ( C-18425r369747_chk )

Verify that the "audit-audispd-plugins" package is installed on the SUSE operating system.

Check that the "audit-audispd-plugins" package is installed on the SUSE operating system with the following command:

# zypper se audit-audispd-plugins

If the "audit-audispd-plugins" package is not installed, this is a finding.

Verify the "au-remote" plugin is enabled with the following command:

# grep -i active /etc/audisp/plugins.d/au-remote.conf
active = yes

If "active" is missing, commented out, or is not set to "yes", this is a finding.

Fix Text (F-18423r369748_fix)
Install the "audit-audispd-plugins" package on the SUSE operating system by running the following command: # sudo zypper install audit-audispd-plugins In /etc/audisp/plugins.d/au-remote.conf, change the value of "active" to "yes", or add "active = yes" if no such setting exists in the file.