Detections
Analytics

1.51 APPL-15-001044

Information

The macOS system must be configured to audit all authorization and authentication events.

GROUP ID: V-268470
RULE ID: SV-268470r1034350

The auditing system must be configured to flag authorization and authentication (aa) events.

Authentication events contain information about the identity of a user, server, or client. Authorization events contain information about permissions, rights, and rules. If audit records do not include aa events, it is difficult to identify incidents and correlate incidents to subsequent events.

Audit records can be generated from various components within the information system (e.g., via a module or policy filter).

Satisfies: SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00211, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000475-GPOS-00220, SRG-OS-000477-GPOS-00222

Solution

Configure the macOS system to audit login events with the following command:

/usr/bin/grep -qE "^flags.*[^-]aa" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,aa/' /etc/security/audit_control; /usr/sbin/audit -s

See Also

https://workbench.cisecurity.org/benchmarks/23761

Item Details

Category: AUDIT AND ACCOUNTABILITY, MAINTENANCE

References: 800-53|AU-12c., 800-53|MA-4(1), CCI|CCI-000172, CCI|CCI-002884, CCI|CCI-003938, Rule-ID|SV-268470r1034350_rule, STIG-ID|APPL-15-001044, Vuln-ID|V-268470

Plugin: Unix

Control ID: 68bf6a9c4a41af2c6ccc642864d4f269d999fdc9730262fd31150e7f3946add8