The system must be configured to send audit records to a remote audit server.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-24357 | GEN002870 | SV-40015r1_rule | ECTB-1 | Low |
| Description |
|---|
| Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host. |
| STIG | Date |
|---|---|
| SOLARIS 9 X86 SECURITY TECHNICAL IMPLEMENTATION GUIDE | 2015-10-01 |
Details
| Check Text ( C-39027r1_chk ) |
|---|
| Audit records may be sent to a remote server via an NFS mount of the audit directory. Check the "dir" parameter in /etc/security/audit_control. If the directory is on an NFS mount to a remote server, there is no finding. If auditd is saving audit records on a local directory, this is a finding. |
| Fix Text (F-34122r1_fix) |
|---|
| Update the /etc/security/audit_control file to save audit records to a remote NFS mount: dir: |