RHEL-07-030700 - The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.

Information

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.

At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.

Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215

Solution

Configure the operating system to generate audit records when successful/unsuccessful attempts to access the '/etc/sudoers' file and files in the '/etc/sudoers.d/' directory.

Add or update the following rule in '/etc/audit/rules.d/audit.rules':

-w /etc/sudoers -p wa -k privileged-actions

-w /etc/sudoers.d/ -p wa -k privileged-actions

The audit daemon must be restarted for the changes to take effect.

Item Details

Audit Name: DISA Red Hat Enterprise Linux 7 STIG v3r15

Category: AUDIT AND ACCOUNTABILITY, MAINTENANCE

Plugin: Unix

Control ID: 69bc9a37c8099e961d0e228df9cc9a2d55d2304c855ef6b27a3944b7ded1b4a7

Detections

Analytics

RHEL-07-030700 - The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.

Information

Solution

See Also

Item Details