STIGQter: STIG Summary: Oracle Linux 7 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Oracle Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.

DISA Rule

SV-221764r603260_rule

Vulnerability Number

V-221764

Group Title

SRG-OS-000038-GPOS-00016

Rule Version

OL07-00-030000

Severity

CAT II

CCI(s)

• CCI-001464 - The information system initiates session audits at system start-up.
• CCI-001487 - The information system generates audit records containing information that establishes the identity of any individuals or subjects associated with the event.
• CCI-001814 - The Information system supports auditing of the enforcement actions.
• CCI-000131 - The information system generates audit records containing information that establishes when an event occurred.
• CCI-000132 - The information system generates audit records containing information that establishes where the event occurred.
• CCI-000135 - The information system generates audit records containing the organization-defined additional, more detailed information that is to be included in the audit records.

Weight

10

Fix Recommendation

Configure the operating system to produce audit records containing information to establish when (date and time) the events occurred.

Enable the auditd service with the following command:

# systemctl start auditd.service

Check Contents

Verify the operating system produces audit records containing information to establish when (date and time) the events occurred.

Check to see if auditing is active by issuing the following command:

# systemctl is-active auditd.service
active

If the "auditd" status is not active, this is a finding.

Vulnerability Number

V-221764

Documentable

False

Rule Version

OL07-00-030000

Severity Override Guidance

Verify the operating system produces audit records containing information to establish when (date and time) the events occurred.

Check to see if auditing is active by issuing the following command:

# systemctl is-active auditd.service
active

If the "auditd" status is not active, this is a finding.

Check Content Reference

M

Target Key

4089

Comments