STIGQter: STIG Summary: Solaris 11 X86 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The operating system must alert designated organizational officials in the event of an audit processing failure.

DISA Rule

SV-216038r603268_rule

Vulnerability Number

V-216038

Group Title

SRG-OS-000046

Rule Version

SOL-11.1-010390

Severity

CAT I

CCI(s)

• CCI-000139 - The information system alerts designated organization-defined personnel or roles in the event of an audit processing failure.

Weight

10

Fix Recommendation

The root role is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this action applies.

Add an audit_warn alias to /etc/mail/aliases that will forward to designated system administrator(s).

# pfedit /etc/mail/aliases

Insert a line in the form:
audit_warn:user1,user2

Put the updated aliases file into service.
# newaliases

Check Contents

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

The root role is required.

Verify the presence of an audit_warn entry in /etc/mail/aliases.
# /usr/lib/sendmail -bv audit_warn
If the response is:
audit_warn... User unknown

this is a finding.

Review the output of the command and verify that the audit_warn alias notifies the appropriate users in this form:

audit_warn:user1,user2

If an appropriate user is not listed, this is a finding.

Vulnerability Number

V-216038

Documentable

False

Rule Version

SOL-11.1-010390

Severity Override Guidance

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

The root role is required.

Verify the presence of an audit_warn entry in /etc/mail/aliases.
# /usr/lib/sendmail -bv audit_warn
If the response is:
audit_warn... User unknown

this is a finding.

Review the output of the command and verify that the audit_warn alias notifies the appropriate users in this form:

audit_warn:user1,user2

If an appropriate user is not listed, this is a finding.

Check Content Reference

M

Target Key

4021

Comments