Detections
Analytics

1.25 SOL-11.1-010360

Information

The auditing system must not define a different auditing level for specific users.

GROUP ID: V-216035RULE ID: SV-216035r959010

Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to an individual account.

Solution

The root role is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

zonename

If the command output is "global", this action applies.

For each user on the system, remove all special audit configuration flags.

usermod -K audit_flags= [username]

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216035r959010_rule, STIG-ID|SOL-11.1-010360, Vuln-ID|V-216035

Plugin: Unix

Control ID: ea0443a4948ec83499722501f8c4a85517d27aa19dc2446eb88eb2e09bbb2e86