The system must be configured to send audit/system records to a remote audit server.

From Oracle Linux 5 Security Technical Implementation Guide

Part of GEN002870

Associated with IA controls: ECTB-1

Associated with: CCI-000136

SV-64419r2_rule The system must be configured to send audit/system records to a remote audit server.

Vulnerability discussion

System/Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host.

Check content

Verify the system is configured to forward all audit records to a remote server. If the system is not configured to provide this function, this is a finding. Procedure: Ensure the audit option for the kernel is enabled. # grep "audit" /boot/grub/grub.conf | grep -v "^#" If the kernel does not have the "audit=1" option specified, this is a finding. Ensure the kernel auditing is active. # grep "active" /etc/audisp/plugins.d/syslog.conf | grep -v "^#" If the "active" setting is either missing or not set to "yes", this is a finding. Ensure all audit records are forwarded to a remote server. # grep "\*.\*" /etc/syslog.conf |grep "@" | grep -v "^#" (for syslog) or: # grep "\*.\*" /etc/rsyslog.conf | grep "@" | grep -v "^#" (for rsyslog) If neither of these lines exist, it is a finding.

Fix text

Configure the system to send audit records to a remote server. Procedure: These instructions assume a known remote audit server is available to this system. Modify /etc/syslog.conf or /etc/rsyslog.conf to contain a line sending all audit records to a remote audit server. The server is specified by placing an "@" before the DNS name or IP address in the line. *.* @ Edit the "active" line in /etc/audisp/plugins.d/syslog.conf so it shows "active = yes". Restart audit and syslog: # service auditd restart # service syslog restart Or: # service rsyslog restart

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer