Detections
Analytics

1.33 APPL-14-001002

Information

The macOS system must be configured to audit all log on and log out events.

GROUP ID: V-259453RULE ID: SV-259453r958406

The audit system must be configured to record all attempts to log in and out of the system (lo).

Frequently, an attacker that successfully gains access to a system has only gained access to an account with limited privileges, such as a guest account or a service account. The attacker must attempt to change to another user account with normal or elevated privileges in order to proceed. Auditing both successful and unsuccessful attempts to switch to another user account (by way of monitoring log on and log out events) mitigates this risk.

The information system monitors log on and log out events.

Satisfies: SRG-OS-000032-GPOS-00013,SRG-OS-000064-GPOS-00033,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000471-GPOS-00216,SRG-OS-000472-GPOS-00217,SRG-OS-000473-GPOS-00218

Solution

Configure the macOS system to audit all log on and log out events with the following command:

/usr/bin/grep -qE "^flags.*[^-]lo" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,lo/' /etc/security/audit_control; /usr/sbin/audit -s

A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.

See Also

https://workbench.cisecurity.org/benchmarks/24070

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MAINTENANCE

References: 800-53|AC-17(1), 800-53|AU-12c., 800-53|MA-4(1), CAT|II, CCI|CCI-000067, CCI|CCI-000172, CCI|CCI-002884, Rule-ID|SV-259453r958406_rule, STIG-ID|APPL-14-001002, Vuln-ID|V-259453

Plugin: Unix

Control ID: 60b709d3f135e6b1ad7cc36ee8d670f15879b0ee783fbff2236f8f603512eb59