STIGQter STIGQter: STIG Summary: Apple macOS 11 (Big Sur) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

The macOS system must generate audit records for DoD-defined events such as successful/unsuccessful logon attempts, successful/unsuccessful direct access attempts, starting and ending time for user access, and concurrent logons to the same account from different sources.

DISA Rule

SV-230784r599842_rule

Vulnerability Number

V-230784

Group Title

SRG-OS-000470-GPOS-00214

Rule Version

APPL-11-001044

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To ensure the appropriate flags are enabled for auditing, run the following command:

/usr/bin/sudo /usr/bin/sed -i.bak '/^flags/ s/$/,aa/' /etc/security/audit_control; /usr/bin/sudo /usr/sbin/audit -s

A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.

Check Contents

To view the currently configured flags for the audit daemon, run the following command:

/usr/bin/sudo /usr/bin/grep ^flags /etc/security/audit_control

Logon events are logged by way of the "aa" flag.

If "aa" is not listed in the result of the check, this is a finding.

Vulnerability Number

V-230784

Documentable

False

Rule Version

APPL-11-001044

Severity Override Guidance

To view the currently configured flags for the audit daemon, run the following command:

/usr/bin/sudo /usr/bin/grep ^flags /etc/security/audit_control

Logon events are logged by way of the "aa" flag.

If "aa" is not listed in the result of the check, this is a finding.

Check Content Reference

M

Target Key

5246

Comments