Detections
Analytics

5.2.3.6 Ensure login and logout events are collected

Information

Monitor login and logout events.

Monitoring login/logout events could provide a system administrator with information associated with brute-force attacks against user logins.

Solution

Edit the file /etc/security/audit_control, with the relevant rules to monitor events like login/logout.

Modify the flags directive to match the following:

flags:lo

This flag should be added if there were other flags previously configured rather than replacing the entire line.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|4.9, CSCv7|16.11, CSCv7|16.13

Plugin: Unix

Control ID: befa627967492f24ff40eab26351262bc81a3b97c6e18de4dfe77be7462cc587