Detections
Analytics
AIX7-00-002006 - AIX must produce audit records containing the full-text recording of privileged commands.
Information
Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.At a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Reset the audit system with the following command:# /usr/sbin/audit shutdown
Start the audit system with the following command:
# /usr/sbin/audit start
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V3R3_STIG.zip
Item Details
Audit Name: DISA IBM AIX 7.x STIG v3r3
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-3(1), CAT|II, CCI|CCI-000135, Rule-ID|SV-215240r958422_rule, STIG-ID|AIX7-00-002006, STIG-Legacy|SV-101355, STIG-Legacy|V-91255, Vuln-ID|V-215240
Plugin: Unix
Control ID: e943bf600c5cd17e5620fc1a15b61f4e2e54e61784bf0a5a0c6a2bdafadeed9a