Detections
Analytics

6.2.1.1 Ensure auditd packages are installed

Information

auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Solution

Run the following command to Install auditd and audispd-plugins

# apt install auditd audispd-plugins

See Also

https://workbench.cisecurity.org/benchmarks/26891

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|SI-5, CSCv7|6.2, Rule-ID|SV-238298r958506_rule, Rule-ID|SV-260591r1015023_rule

Plugin: Unix

Control ID: 420d798303a4bc3c80eb88cf544ae787b67b8d4d6fa3cb5f6eea67f9d528096b