Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-814 | GEN002720 | SV-45295r1_rule | Medium |
Description |
---|
If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. |
STIG | Date |
---|---|
SUSE Linux Enterprise Server v11 for System z | 2016-12-20 |
Check Text ( C-42643r1_chk ) |
---|
Verify auditd is configured to audit failed file access attempts. There must be an audit rule for each of the access syscalls logging all failed accesses (-F success=0) or there must both an "-F exit=-EPERM" and "-F exit=-EACCES" for each access syscall. Procedure: # cat /etc/audit/audit.rules | grep -e "-a exit,always" | grep -e "-S creat" | grep -e "-F success=0" # cat /etc/audit/audit.rules | grep -e "-a exit,always" | grep -e "-S creat" | grep -e "-F exit=-EPERM" # cat /etc/audit/audit.rules | grep -e "-a exit,always" | grep -e "-S creat" | grep -e "-F exit=-EACCES" If an "-S creat" audit rule with "-F success" does not exist and no separate rules containing "-F exit=-EPERM" and "-F exit=-EACCES" for "creat" exist, then this is a finding. |
Fix Text (F-38691r1_fix) |
---|
Edit the audit.rules file and add the following line(s) to enable auditing of failed attempts to access files and programs: either: -a exit,always -F arch= or both: -a exit,always -F arch= -a exit,always -F arch= Restart the auditd service. # service auditd restart |