The operating system must generate audit records when successful/unsuccessful logon attempts occur.

From Apple OS X 10.10 (Yosemite) Workstation Security Technical Implementation Guide

Part of SRG-OS-000470

Associated with: CCI-000172

SV-74019r1_rule The operating system must generate audit records when successful/unsuccessful logon attempts occur.

Vulnerability discussion

An attacker might attempt to log in as an authorized user, through stolen credentials, unpatched exploits, or brute force attempts to guess a valid username and password. If a user is attempting to log in to a system at an unusual time, or if there are many failed attempts, there is a possibility that the system is the target of an attack. Auditing logon events mitigates this risk by recording all logon attempts, successful and unsuccessful, to the system.

Check content

In order to view the currently configured flags for the audit daemon, run the following command: sudo grep ^flags /etc/security/audit_control Logon events are logged by way of the 'aa' flag. If 'aa' is not listed in the result of the check, this is a finding.

Fix text

To make sure the appropriate flags are enabled for auditing, run the following command: sudo sed -i.bak '/^flags/ s/$/,aa/' /etc/security/audit_control; sudo audit -s A text editor may also be used to implement the required updates to the /etc/security/audit_control file.

Pro Tips

Powered by sagemincer