Detections
Analytics

GEN002751 - The audit system must be configured to audit account modification - 'group'

Information

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Solution

Configure execute auditing of the usermod and groupmod executables. Add the following to the audit.rules file:
-w /usr/sbin/usermod -p x -k usermod
-w /usr/sbin/groupmod -p x -k groupmod
Configure append auditing of the passwd, shadow, group, and gshadow files. Add the following to the audit.rules file:
-w /etc/passwd -p w -k passwd
-w /etc/shadow -p w -k shadow
-w /etc/group -p w -k group
-w /etc/gshadow -p w -k gshadow
Restart the auditd service.

See Also

http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(4), CAT|III, CCI|CCI-001403, Group-ID|V-22377, Rule-ID|SV-26520r1_rule, STIG-ID|GEN002751, Vuln-ID|V-22377

Plugin: Unix

Control ID: 424948e43fb1763878dee69e23915a97f8066edbad8d79b85b1988b8116691f3