STIGQter: STIG Summary: Red Hat Enterprise Linux 7 Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 23 Apr 2021:

The Red Hat Enterprise Linux operating system must generate audit records for all successful account access events.

DISA Rule

SV-204541r603261_rule

Vulnerability Number

V-204541

Group Title

SRG-OS-000392-GPOS-00172

Rule Version

RHEL-07-030620

Severity

CAT II

CCI(s)

• CCI-000126 - The organization determines that the organization-defined subset of the auditable events defined in AU-2 are to be audited within the information system.
• CCI-000172 - The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
• CCI-002884 - The organization audits nonlocal maintenance and diagnostic sessions^ organization-defined audit events.

Weight

10

Fix Recommendation

Configure the operating system to generate audit records when successful account access events occur.

Add or update the following rule in "/etc/audit/rules.d/audit.rules":

-w /var/log/lastlog -p wa -k logins

The audit daemon must be restarted for the changes to take effect.

Check Contents

Verify the operating system generates audit records when successful account access events occur.

Check the file system rules in "/etc/audit/audit.rules" with the following commands:

# grep -i /var/log/lastlog /etc/audit/audit.rules

-w /var/log/lastlog -p wa -k logins

If the command does not return any output, this is a finding.

Vulnerability Number

V-204541

Documentable

False

Rule Version

RHEL-07-030620

Severity Override Guidance

Verify the operating system generates audit records when successful account access events occur.

Check the file system rules in "/etc/audit/audit.rules" with the following commands:

# grep -i /var/log/lastlog /etc/audit/audit.rules

-w /var/log/lastlog -p wa -k logins

If the command does not return any output, this is a finding.

Check Content Reference

M

Target Key

2899

Comments