GEN003800 - Inetd or xinetd logging/tracing must be enabled - '/etc/xinetd.conf log_on_failure'

Information

Inetd or xinetd logging and tracing allows the system administrators to observe the IP addresses connecting to their machines and what network services are being sought. This provides valuable information when trying to find the source of malicious users and potential malicious users.

Solution

Edit each file in the /etc/xinetd.d directory and the /etc/xinetd.conf file to contain:
log_type = SYSLOG authpriv
log_on_success = HOST PID USERID EXIT
log_on_failure = HOST USERID

The /etc/xinetd.conf file contains default values that will hold true for all services unless individually modified in the service's xinetd.d file.

To make the new settings effective, restart the xinetd service:
# service xinetd restart

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_5_V2R1_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, CAT|III, CCI|CCI-000134, Rule-ID|SV-218509r603259_rule, STIG-ID|GEN003800, STIG-Legacy|SV-63989, STIG-Legacy|V-1011, Vuln-ID|V-218509

Plugin: Unix

Control ID: 2806b068ec4d2b4e68535f97f16b541596d48ec89630fe8ebdd1aa7200d9ec97