UCF STIG Viewer Logo

The operating system must automatically audit account disabling actions.


Overview

Finding ID Version Rule ID IA Controls Severity
V-216261 SOL-11.1-010260 SV-216261r793016_rule Medium
Description
Without auditing, malicious activity cannot be detected.
STIG Date
Solaris 11 SPARC Security Technical Implementation Guide 2021-11-23

Details

Check Text ( C-17497r793015_chk )
The Audit Configuration profile is required.

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

Determine the OS version you are currently securing.
# uname –v

For Solaris 11, 11.1, 11.2, and 11.3:

# pfexec auditconfig -getflags | grep active | cut -f2 -d=

If "ps" audit flag is not included in output, this is a finding.

For Solaris 11.4 or newer:

# pfexec auditconfig -t -getflags | cut -f2 -d=

If "cusa" or if the "ft,lo,ap,ss,as,ua,pe” audit flag(s) are not included in output, this is a finding.

Determine if auditing policy is set to collect command line arguments.

# pfexec auditconfig -getpolicy | grep active | grep argv

If the active audit policies line does not appear, this is a finding.
Fix Text (F-17495r370872_fix)
The Audit Configuration profile is required. All audit flags must be enabled in a single command.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this action applies.

For Solaris 11, 11.1, 11.2, and 11.3:
# pfexec auditconfig -setflags cusa,-ps,fd,-fa,fm

For Solaris 11.4 or newer:
# pfexec auditconfig -setflags cusa,-fa,-ex,-ps,fd,fm

Enable the audit policy to collect command line arguments.

# pfexec auditconfig -setpolicy +argv

These changes will not affect users that are currently logged in.