The system must be configured to send audit records to a remote audit server.

From HP-UX 11.31 Security Technical Implementation Guide

Part of GEN002870

Associated with IA controls: ECTB-1

Associated with: CCI-000136

SV-38413r1_rule The system must be configured to send audit records to a remote audit server.

Vulnerability discussion

Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host.

Check content

The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. The vendor (HP) recommends that a script be written to implement a long term strategy for data storage and pass it to the audomon daemon using the "-X " option. is executed each time audomon switches the audit trail. The means used to implement audit log transfer to a remote system will be site specific and therefore always require a manual review. ASK the SA if audomon is configured per the vendor's (HP) guidance to implement a long term, remote data storage strategy.

Fix text

The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. Create a script to implement the vendor-recommended, long term data storage strategy and pass it to the audomon daemon using the "-X " option. The must be executed each time audomon switches the audit trail. A manual review of the script is required.

Pro Tips

Powered by sagemincer