STIGQter: STIG Summary: Red Hat Enterprise Linux 7 Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 23 Apr 2021:

The Red Hat Enterprise Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.

DISA Rule

SV-204503r603261_rule

Vulnerability Number

V-204503

Group Title

SRG-OS-000038-GPOS-00016

Rule Version

RHEL-07-030000

Severity

CAT II

CCI(s)

• CCI-000126 - The organization determines that the organization-defined subset of the auditable events defined in AU-2 are to be audited within the information system.
• CCI-000131 - The information system generates audit records containing information that establishes when an event occurred.

Weight

10

Fix Recommendation

Configure the operating system to produce audit records containing information to establish when (date and time) the events occurred.

Enable the auditd service with the following command:

# systemctl start auditd.service

Check Contents

Verify the operating system produces audit records containing information to establish when (date and time) the events occurred.

Check to see if auditing is active by issuing the following command:

# systemctl is-active auditd.service
active

If the "auditd" status is not active, this is a finding.

Vulnerability Number

V-204503

Documentable

False

Rule Version

RHEL-07-030000

Severity Override Guidance

Verify the operating system produces audit records containing information to establish when (date and time) the events occurred.

Check to see if auditing is active by issuing the following command:

# systemctl is-active auditd.service
active

If the "auditd" status is not active, this is a finding.

Check Content Reference

M

Target Key

2899

Comments