Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-22377 | GEN002751 | SV-45308r1_rule | Low |
Description |
---|
If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. |
STIG | Date |
---|---|
SUSE Linux Enterprise Server v11 for System z | 2016-12-20 |
Check Text ( C-42655r1_chk ) |
---|
Determine if execution of the usermod and groupmod executable are audited. # auditctl -l | egrep '(usermod|groupmod)' If either usermod or groupmod are not listed with a permissions filter of at least 'x', this is a finding. Determine if /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow are audited for writing. # auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow)' If any of these are not listed with a permissions filter of at least 'w', this is a finding. |
Fix Text (F-38703r1_fix) |
---|
Configure execute auditing of the usermod and groupmod executables. Add the following to the audit.rules file: -w /usr/sbin/usermod -p x -k usermod -w /usr/sbin/groupmod -p x -k groupmod Configure append auditing of the passwd, shadow, group, and gshadow files. Add the following to the audit.rules file: -w /etc/passwd -p w -k passwd -w /etc/shadow -p w -k shadow -w /etc/group -p w -k group -w /etc/gshadow -p w -k gshadow Restart the auditd service. # rcauditd restart OR # service auditd restart |