Detections
Analytics

6.2.1.2 Ensure auditing for processes that start prior to auditd is enabled

Information

The audit=1 kernel boot parameter enables the Linux Auditing System early in the boot process, before the auditd service starts.

Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go undetected.

Solution

Run the following command to update the grub2 configuration with audit=1 :

# grubby --update-kernel ALL --args 'audit=1'

Edit /etc/default/grub and add audit=1 to the GRUB_CMDLINE_LINUX= line between the opening and closing double quotes:

Example:

GRUB_CMDLINE_LINUX="quiet audit=1"

Note: audit=1 is a kernel boot parameter; the change takes effect on the next reboot.

Impact:

Auditing processes that start before auditd increases the volume of audit records captured during early boot.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-12, CSCv7|6.2

Plugin: Unix

Control ID: f1bcb8b553e4e13bab008a141b59f41ef982f6c75f513d8e4fa72b0d7d9f9fa7