Detections
Analytics

GEN002800 - The audit system must be configured to audit login, logout, and session initiation - 'faillog'

Information

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Solution

Ensure logins

Procedure:
Modify /etc/audit/audit.rules to contain:

-w /var/log/faillog -p wa
-w /var/log/lastlog -p wa

See Also

http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-5(1), CAT|II, CCI|CCI-000347, Group-ID|V-818, Rule-ID|SV-37664r1_rule, STIG-ID|GEN002760-9, Vuln-ID|V-29248

Plugin: Unix

Control ID: a85be2aef763f8851231c08487ad482fa293fa8df5e820de92fc52456ffe11a3