Detections
Analytics
RHEL-10-500005 - RHEL 10 must enable auditing of processes that start prior to the audit daemon.
Information
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.If auditing is enabled late in the startup process, the actions of some startup processes may not be audited. Some audit systems also maintain state information available only if auditing is enabled before a given process is created.
Solution
Configure RHEL 10 to enable auditing of processes that start prior to the audit daemon with the following command:$ sudo grubby --update-kernel=ALL --args="audit=1"
Add or modify the following line in "/etc/default/grub" to ensure the configuration survives kernel updates:
GRUB_CMDLINE_LINUX="audit=1"
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_10_V1R1_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 10 STIG v1r1
Category: ACCESS CONTROL
References: 800-53|AC-3, CAT|II, CCI|CCI-000213, Rule-ID|SV-281097r1165646_rule, STIG-ID|RHEL-10-500005, Vuln-ID|V-281097
Plugin: Unix
Control ID: a784308c1679a0bbecece050dc8a5b3639da8f8142ee10d5a00f1ef73aa8d779