Detections
Analytics

GEN000440 - Successful and unsuccessful logins and logouts must be logged.

Information

Monitoring and recording successful and unsuccessful logins assist in tracking unauthorized access to the system. Without this logging, the ability to track unauthorized activity to specific user accounts may be diminished.

Solution

Verify that login logs are handled correctly in the /etc/syslog.conf file. Edit the /etc/syslog.conf file and add one of the entries below.

auth.debug /var/log/authlog
OR
auth.* /var/log/authlog

Verify that service startup scripts for syslog and utmp (if present) are enabled.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_10_x86_V2R4_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CAT|II, CCI|CCI-000172, Rule-ID|SV-227577r603266_rule, STIG-ID|GEN000440, STIG-Legacy|SV-27080, STIG-Legacy|V-765, Vuln-ID|V-227577

Plugin: Unix

Control ID: afd6974e51c2a9a4b4f091fb61a38c89f2560341d6b37831bba1d793c70bfa98