Detections
Analytics

1.216 SOL-11.1-100050

Information

The audit system must maintain a central audit trail for all zones.

GROUP ID: V-216478
RULE ID: SV-216478r959010

Centralized auditing simplifies the investigative process to determine the cause of a security event.

Solution

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

List the non-global zones on the system.

# zoneadm list -vi | grep -v global

The Audit Configuration profile is required.

Disable the "perzone" auditing policy.

# pfexec auditconfig -setpolicy -perzone

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216478r959010_rule, STIG-ID|SOL-11.1-100050, Vuln-ID|V-216478

Plugin: Unix

Control ID: ec244a0621bd16021b9b3a78516f840e84c48dd479e924d7412f27d4c90d6791