GEN002870 - The system must be configured to send audit records to a remote audit server - '/etc/rsyslog.conf contains *.* @<server>'

Information

System/Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host.

Solution

Configure the system to send audit records to a remote server.

Procedure:
These instructions assume a known remote audit server is available to this system.
Modify /etc/syslog.conf or /etc/rsyslog.conf to contain a line sending all audit records to a remote audit server. The server is specified by placing an '@' before the DNS name or IP address in the line.

*.* @<remote audit server>

Edit the 'active' line in /etc/audisp/plugins.d/syslog.conf so it shows 'active = yes'.

Restart audit and syslog:
# service auditd restart
# service syslog restart
Or:
# service rsyslog restart

See Also

http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3(2), CAT|III, CCI|CCI-000136, Group-ID|V-24357, Rule-ID|SV-37948r4_rule, STIG-ID|GEN002870, Vuln-ID|V-24357

Plugin: Unix

Control ID: 385a1c29574357f20d40bc6cc31d774cf5990e56287de02c715a89521b32c235