Detections
Analytics

8.1.2 Ensure Audit bin(ary) audit event collection is configured

Information

This recommendation configures AIX auditing in bin mode.

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure AIX auditing in-line with the High Level AIX Security Expert policy.

Create a /audit filesystem, at least 100 MB in size:

mklv -y <LV name> -t jfs2 -u 1 -c 1 rootvg 1 hdisk0
crfs -v jfs2 -d auditlv -m /audit -A yes -t no
mount /audit

Reflect the following configuration in the /etc/security/audit/config file:

vi /etc/security/audit/config

Add in:

start:
 binmode = on
 streammode = off
bin:
 trail = /audit/trail
 bin1 = /audit/bin1
 bin2 = /audit/bin2
 binsize = 10240
 cmds = /etc/security/audit/bincmds

Add the auditing entries for root and all other users below the pre-defined audit classes:

users:
 root = general,SRC,mail,cron,tcpip,ipsec,lvm
 <user 1> = general,SRC,cron,tcpip
 <user 2> = general,SRC,cron,tcpip
 etc.

Update the /usr/lib/security/mkuser.default auditclasses entry to ensure that auditing is set up for any newly created users:

chsec -f /usr/lib/security/mkuser.default -s user -a
auditclasses=general,SRC,cron,tcpip

A cron job is implemented to monitor the free space in /audit, running hourly, to ensure that /audit does not fill up. If /audit is greater than 90% used, /audit/trail is moved to /audit/trailOneLevelBack :

crontab -e

Add in:

0 * * * * /etc/security/aixpert/bin/cronaudit

NOTE: The implementation of a script to suit internal security policy is recommended to further enhance the log rotation process.

Add the audit startup command into /etc/inittab :

mkitab "audit:2:boot:audit start > /dev/console 2>&1 # Start audit"

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 8446b19ad79b24d4ae50c678cd5c983fd30db7646ba4e37ad80687ab72a77340