Detections
Analytics

1.437 ALMA-09-056780

Information

AlmaLinux OS 9 audit system must protect logon UIDs from unauthorized change.

GROUP ID: V-269544
RULE ID: SV-269544r1050427

If modification of login user identifiers (UIDs) is not prevented, they can be changed by nonprivileged users and make auditing complicated or impossible.

Solution

Configure AlmaLinux OS 9 auditing to prevent modification of login UIDs once they are set by adding the following line to /etc/audit/rules.d/audit.rules:

--loginuid-immutable

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9, CCI|CCI-000163, Rule-ID|SV-269544r1050427_rule, STIG-ID|ALMA-09-056780, Vuln-ID|V-269544

Plugin: Unix

Control ID: 7d1b5a7cb8d5cb96a982fa12270580c43471b5a300c493de345b3a58788a6312