The operating system must generate audit records for all account creations, modifications, disabling, and termination events.

From Apple OS X 10.10 (Yosemite) Workstation Security Technical Implementation Guide

Part of SRG-OS-000476

Associated with: CCI-000172

SV-74025r1_rule The operating system must generate audit records for all account creations, modifications, disabling, and termination events.

Vulnerability discussion

Account creations and account modifications such as disablement and termination, can all be signs of an intrusion and should be audited. Once an attacker establishes access to a system, the attacker may attempt to create an account to reestablish access at a later time. The attacker may also attempt to modify accounts in an attempt to change an existing account's privileges or disable or delete accounts in a denial-of-service attack. Auditing of account creation, modification, disabling, and termination events mitigates this risk.

Check content

In order to view the currently configured flags for the audit daemon, run the following command: sudo grep ^flags /etc/security/audit_control Privileged access, including the creation, modification, and deletion of local user accounts, is logged via the 'ad' flag. If 'ad' is not listed in the result of the check, this is a finding.

Fix text

To make sure the appropriate flags are enabled for auditing, run the following command: sudo sed -i.bak '/^flags/ s/$/,ad/' /etc/security/audit_control; sudo audit -s A text editor may also be used to implement the required updates to the /etc/security/audit_control file.

Pro Tips

Powered by sagemincer