STIGQter: STIG Summary: IBM AIX 7.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

AIX must be configured so that the audit system takes appropriate action when the audit storage volume is full.

DISA Rule

SV-219956r508663_rule

Vulnerability Number

V-219956

Group Title

SRG-OS-000342-GPOS-00133

Rule Version

AIX7-00-002017

Severity

CAT II

CCI(s)

• CCI-001851 - The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.

Weight

10

Fix Recommendation

Edit the /etc/security/audit/config file and add/modify the following values:

Note: The values for "binsize" and "freespace" are the minimum required values. These values can be increased to meet organizationally defined values that exceed the listed values.

bin:
trail = /audit/trail
bin1 = /audit/bin1
bin2 = /audit/bin2
binsize = 25000
cmds = /etc/security/audit/bincmds
freespace = 65536
backuppath = /audit
backupsize = 0
bincompact = off

Restart the audit process:
# /usr/sbin/audit shutdown
# /usr/sbin/audit start

Check Contents

Verify the action the operating system takes if the disk the audit records are written to becomes full.

Verify that the file "/etc/security/audit/config" includes the required settings with the following command:

# cat /etc/security/audit/config

bin:
trail = /audit/trail
bin1 = /audit/bin1
bin2 = /audit/bin2
binsize = 25000
cmds = /etc/security/audit/bincmds
freespace = 65536
backuppath = /audit
backupsize = 0
bincompact = off

If any of the configurations listed above is missing or not set to the listed value or greater, this is a finding.

Vulnerability Number

V-219956

Documentable

False

Rule Version

AIX7-00-002017

Severity Override Guidance

Verify the action the operating system takes if the disk the audit records are written to becomes full.

Verify that the file "/etc/security/audit/config" includes the required settings with the following command:

# cat /etc/security/audit/config

bin:
trail = /audit/trail
bin1 = /audit/bin1
bin2 = /audit/bin2
binsize = 25000
cmds = /etc/security/audit/bincmds
freespace = 65536
backuppath = /audit
backupsize = 0
bincompact = off

If any of the configurations listed above is missing or not set to the listed value or greater, this is a finding.

Check Content Reference

M

Target Key

4012

Comments