STIGQter: STIG Summary: Solaris 11 SPARC Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The operating system must protect the audit records resulting from non-local accesses to privileged accounts and the execution of privileged functions.

DISA Rule

SV-219985r603267_rule

Vulnerability Number

V-219985

Group Title

SRG-OS-000327

Rule Version

SOL-11.1-070250

Severity

CAT II

CCI(s)

• CCI-002234 - The information system audits the execution of privileged functions.

Weight

10

Fix Recommendation

The root role is required.

Determine the location of the local audit trail files.

# pfexec auditconfig -getplugin audit_binfile
Plugin: audit_binfile (active)
Attributes: p_dir=/var/audit;p_fsize=4M;p_minfree=1

In this example, the audit files can be found in /var/audit.

Change the permissions on the audit trail files and the audit directory.

# chmod 640 /var/share/audit/*

# chmod 750 /var/share/audit

Note: The default Solaris 11 location for /var/audit is a link to /var/share/audit.

Check Contents

The audit configuration profile is required.

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

Determine the location of the local audit trail files.

# auditconfig -getplugin audit_binfile
Plugin: audit_binfile (active)
Attributes: p_dir=/var/audit;p_fsize=4M;p_minfree=1;"

In this example, the audit files can be found in /var/audit. Check that the permissions on the audit files are 640 (rw- r-- --) or less permissive.

# ls -al /var/audit

# ls -l /var/audit/*

If the permissions are more permissive than 640, this is a finding.

Note: The default Solaris 11 location for /var/audit is a link to /var/share/audit.

Vulnerability Number

V-219985

Documentable

False

Rule Version

SOL-11.1-070250

Severity Override Guidance

The audit configuration profile is required.

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

Determine the location of the local audit trail files.

# auditconfig -getplugin audit_binfile
Plugin: audit_binfile (active)
Attributes: p_dir=/var/audit;p_fsize=4M;p_minfree=1;"

In this example, the audit files can be found in /var/audit. Check that the permissions on the audit files are 640 (rw- r-- --) or less permissive.

# ls -al /var/audit

# ls -l /var/audit/*

If the permissions are more permissive than 640, this is a finding.

Note: The default Solaris 11 location for /var/audit is a link to /var/share/audit.

Check Content Reference

M

Target Key

4022

Comments