AOSX-13-000030 - The macOS system must monitor remote access methods and generate audit records when successful/unsuccessful attempts to access/modify privileges occur.

Information

Frequently, an attacker that successfully gains access to a system has only gained access to an account with limited privileges, such as a guest account or a service account. The attacker must attempt to change to another user account with normal or elevated privileges in order to proceed. Auditing successful and unsuccessful attempts to switch to another user account and the escalation of privileges mitigates this risk.

Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206

Solution

To ensure the appropriate flags are enabled for auditing, run the following command:

/usr/bin/sudo sed -i.bak '/^flags/ s/$/,lo/' /etc/security/audit_control; /usr/bin/sudo /usr/sbin/audit -s

A text editor may also be used to implement the required updates to the '/etc/security/audit_control' file.

Item Details

Audit Name: DISA STIG Apple Mac OSX 10.13 v2r5

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

Plugin: Unix

Control ID: 05ba743308dee17d695c20a4cb8dd8d472651d2e291b7b22947452adfc49643b

Detections

Analytics

AOSX-13-000030 - The macOS system must monitor remote access methods and generate audit records when successful/unsuccessful attempts to access/modify privileges occur.

Information

Solution

See Also

Item Details