Detections
Analytics

1.215 SOL-11.1-100050

Information

The audit system must maintain a central audit trail for all zones.

GROUP ID: V-216242RULE ID: SV-216242r959010

Centralized auditing simplifies the investigative process to determine the cause of a security event.

Solution

This check applies to the global zone only. Determine the zone that you are currently securing.

zonename

If the command output is "global", this check applies.

List the non-global zones on the system.

zoneadm list -vi | grep -v global

The Audit Configuration profile is required.

Disable the "perzone" auditing policy.

pfexec auditconfig -setpolicy -perzone

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216242r959010_rule, STIG-ID|SOL-11.1-100050, Vuln-ID|V-216242

Plugin: Unix

Control ID: 8631c2d4ad95b65f53023859bb1cffd89a56536739e103a2f3ac5f3d7dde42f1