Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-29236 | GEN002720-2 | SV-45286r1_rule | ECAR-1 ECAR-2 ECAR-3 | Medium |
Description |
---|
If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. |
STIG | Date |
---|---|
SUSE Linux Enterprise Server v11 for System z | 2016-12-20 |
Check Text ( C-42633r1_chk ) |
---|
Check that auditd is configured to audit failed file access attempts. There must be an audit rule for each of the access syscalls that logs all failed accesses (-F success=0) or there must both an "-F exit=-EPERM" and "-F exit=-EACCES" for each access syscall. Procedure: # cat /etc/audit/audit.rules | grep -e "-a exit,always" | grep -e "-S open" | grep -e "-F success=0" # cat /etc/audit/audit.rules | grep -e "-a exit,always" | grep -e "-S open" | grep -e "-F exit=-EPERM" # cat /etc/audit/audit.rules | grep -e "-a exit,always" | grep -e "-S open" | grep -e "-F exit=-EACCES" If an "-S open" audit rule with "-F success" does not exist and no separate rules containing "-F exit=-EPERM" and "-F exit=-EACCES" for "open" exist, then this is a finding. |
Fix Text (F-38682r1_fix) |
---|
Edit the audit.rules file and add the following line(s) to enable auditing of failed attempts to access files and programs: either: -a exit,always -F arch= or both: -a exit,always -F arch= -a exit,always -F arch= Restart the auditd service. # rcauditd restart OR # service auditd restart |