Detections
Analytics

ALMA-09-006070 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect the files within /etc/sudoers.d/

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Audit records provide a means to investigate events related to a security incident. Insufficient audit coverage will make identifying those responsible challenging or impossible.

This auditd policy will watch for and alert the system administrators regarding any modifications to the files within "/etc/sudoers.d/" such as adding privileged users, groups, or commands.

Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221

Solution

Configure AlmaLinux OS 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/.

Add the following to the "/etc/audit/rules.d/audit.rules" file:

-w /etc/sudoers.d/ -p wa -k identity

Merge the rules into /etc/audit/audit.rules:

$ augenrules --load

Reboot the server so the changes to take effect.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CL_AlmaLinux_OS_9_V1R6_STIG.zip

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MAINTENANCE

References: 800-53|AC-2(1), 800-53|AC-2(4), 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-12a., 800-53|AU-12c., 800-53|MA-4(1)(a), CAT|II, CCI|CCI-000015, CCI|CCI-000018, CCI|CCI-000130, CCI|CCI-000135, CCI|CCI-000169, CCI|CCI-000172, CCI|CCI-001403, CCI|CCI-001404, CCI|CCI-001405, CCI|CCI-002130, CCI|CCI-002884, Rule-ID|SV-269135r1050017_rule, STIG-ID|ALMA-09-006070, Vuln-ID|V-269135

Plugin: Unix

Control ID: 98308bfc2b33d1b3456a497490c5630e6bf56279d73c6b24f49dd451df153401