Detections
Analytics
GEN002800 - The audit system must be configured to audit login, logout, and session initiation - 'lastlog'
Information
If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.Solution
Ensure logins.Procedure:
Modify /etc/audit/audit.rules to contain:
-w /var/log/faillog -p wa
-w /var/log/lastlog -p wa
Restart the auditd service:
# service auditd restart
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_5_V2R1_STIG.zip
Item Details
Audit Name: DISA STIG for Oracle Linux 5 v2r1
Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT
References: 800-53|AU-2d., 800-53|CM-6b., CAT|II, CCE|CCE-14904-7, CCI|CCI-000126, CCI|CCI-000366, Rule-ID|SV-218407r603259_rule, STIG-ID|GEN002800, STIG-Legacy|SV-65285, STIG-Legacy|V-818, Vuln-ID|V-218407
Plugin: Unix
Control ID: f789e75597e2e03da0a6f976550bcc804a6594ed2800d605b50ac935c13a83e9