STIGQter: STIG Summary: Oracle Linux 7 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Oracle Linux operating system must use a separate file system for the system audit data path large enough to hold at least one week of audit data.

DISA Rule

SV-221756r603260_rule

Vulnerability Number

V-221756

Group Title

SRG-OS-000341-GPOS-00132

Rule Version

OL07-00-021330

Severity

CAT III

CCI(s)

• CCI-001849 - The organization allocates audit record storage capacity in accordance with organization-defined audit record storage requirements.

Weight

10

Fix Recommendation

Migrate the system audit data path onto an appropriately sized separate file system to store at least one week of audit records.

Check Contents

Determine if the operating system is configured to have the "/var/log/audit" path is on a separate file system.

# grep /var/log/audit /etc/fstab

If no result is returned, or the operating system is not configured to have "/var/log/audit" on a separate file system, this is a finding.

Verify that "/var/log/audit" is mounted on a separate file system:

# mount | grep "/var/log/audit"

If no result is returned, or "/var/log/audit" is not on a separate file system, this is a finding.

Verify the size of the audit file system:

# df -h /var/log/audit

If the size is insufficient for a week of audit data, this is a finding.

Vulnerability Number

V-221756

Documentable

False

Rule Version

OL07-00-021330

Severity Override Guidance

Determine if the operating system is configured to have the "/var/log/audit" path is on a separate file system.

# grep /var/log/audit /etc/fstab

If no result is returned, or the operating system is not configured to have "/var/log/audit" on a separate file system, this is a finding.

Verify that "/var/log/audit" is mounted on a separate file system:

# mount | grep "/var/log/audit"

If no result is returned, or "/var/log/audit" is not on a separate file system, this is a finding.

Verify the size of the audit file system:

# df -h /var/log/audit

If the size is insufficient for a week of audit data, this is a finding.

Check Content Reference

M

Target Key

4089

Comments