Detections
Analytics

6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled

Information

Configure grub2 so that processes that are capable of being audited can be audited even if they start up prior to auditd startup.

Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go undetected.

Solution

Edit /etc/default/grub or a file in /etc/default/grub.d/ ending in .cfg and append audit=1 to the existing GRUB_CMDLINE_LINUX value.

Note: Files in /etc/default/grub.d/ are sourced sequentially by /etc/default/grub . A bare assignment like GRUB_CMDLINE_LINUX="audit=1" will replace any existing value (silently dropping parameters such as quiet splash ). Always expand the existing variable when appending.

Example:

# printf '\nGRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} audit=1"\n' >> /etc/default/grub.d/40-custom.cfg

Run the following command to update the grub2 configuration:

# update-grub

A reboot is required for the kernel command-line parameter to take effect.

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: Unix

Control ID: 04b3122af72a57d6c6385a94837506270a05ca41a5b6eee55c6a975e2bb6cf59