Detections
Analytics

1.103 AZLX-23-002160

Information

Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.

GROUP ID: V-274096RULE ID: SV-274096r1120276

Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218

Solution

Configure Amazon Linux 2023 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock".

Add or update the following file system rule to "/etc/audit/rules.d/audit.rules":

-w /var/log/faillock -p wa -k logins

To load the rules to the kernel immediately, use the following command:

$ sudo augenrules --load

See Also

https://workbench.cisecurity.org/benchmarks/26107

Item Details

Category: AUDIT AND ACCOUNTABILITY, MAINTENANCE

References: 800-53|AU-12c., 800-53|MA-4(1), CAT|II, CCI|CCI-000172, CCI|CCI-002884, Rule-ID|SV-274096r1120276_rule, STIG-ID|AZLX-23-002160, Vuln-ID|V-274096

Plugin: Unix

Control ID: d032b29aec498f4c7a8d15857168addcaffeb8c82bab51b33117fc54fccfe8e7