The system must be configured to send audit records to a remote audit server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-24357	GEN002870	SV-39881r1_rule	ECTB-1	Low

Description
Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host.

STIG	Date
Solaris 10 SPARC Security Technical Implementation Guide	2013-04-09

Details

Check Text ( C-38887r1_chk )
Audit records may be sent to a remote server in two ways, via an NFS mount of the audit directory, or via the audit_syslog plugin (if available). NFS: Check the "dir" parameter in /etc/security/audit_control. If the directory is on an NFS mount to a remote server, there is no finding. SYSLOG: Check the "plugin" parameter in /etc/security/audit_control. Confirm that the audit_syslog.so* plugin is listed with "p_flags=all". # grep audit_syslog.so /etc/security/audit_control Check that syslogd is sending messages to a remote server (GEN005450): # grep '@' /etc/syslog.conf \| grep -v '^#' If both auditd is configured to send audit records to syslog, and syslogd is configured to send messages to a remote server, there is no finding. If auditd is saving audit records on a local directory, and audit records are not being sent to a remote server via syslog, this is a finding.

Check Text ( C-38887r1_chk )

Audit records may be sent to a remote server in two ways, via an NFS mount of the audit directory, or via the audit_syslog plugin (if available).

NFS:
Check the "dir" parameter in /etc/security/audit_control. If the directory is on an NFS mount to a remote server, there is no finding.

SYSLOG:
Check the "plugin" parameter in /etc/security/audit_control. Confirm that the audit_syslog.so* plugin is listed with "p_flags=all".
# grep audit_syslog.so /etc/security/audit_control
Check that syslogd is sending messages to a remote server (GEN005450):
# grep '@' /etc/syslog.conf | grep -v '^#'
If both auditd is configured to send audit records to syslog, and syslogd is configured to send messages to a remote server, there is no finding.

If auditd is saving audit records on a local directory, and audit records are not being sent to a remote server via syslog, this is a finding.

Fix Text (F-34029r1_fix)
Update the /etc/security/audit_control file to save audit records to a remote NFS mount. dir: OR If the /usr/lib/security/audit_syslog.so* exists, update the /etc/security/audit_control file to send all audit records to syslog and update /etc/syslog.conf to send all audit messages to a remote server. /etc/security/audit_control: plugin:name=audit_syslog.so.1: p_flags=all /etc/syslog.conf: audit.* @

Fix Text (F-34029r1_fix)

Update the /etc/security/audit_control file to save audit records to a remote NFS mount.

dir:

OR

If the /usr/lib/security/audit_syslog.so* exists, update the /etc/security/audit_control file to send all audit records to syslog and update /etc/syslog.conf to send all audit messages to a remote server.

/etc/security/audit_control:
plugin:name=audit_syslog.so.1: p_flags=all

/etc/syslog.conf:
audit.* @