STIGQter: STIG Summary: SLES 12 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The audit-audispd-plugins must be installed on the SUSE operating system.

DISA Rule

SV-217197r603262_rule

Vulnerability Number

V-217197

Group Title

SRG-OS-000342-GPOS-00133

Rule Version

SLES-12-020070

Severity

CAT II

CCI(s)

• CCI-001851 - The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.

Weight

10

Fix Recommendation

Install the "audit-audispd-plugins" package on the SUSE operating system by running the following command:

# sudo zypper install audit-audispd-plugins

In /etc/audisp/plugins.d/au-remote.conf, change the value of "active" to "yes", or add "active = yes" if no such setting exists in the file.

Check Contents

Verify that the "audit-audispd-plugins" package is installed on the SUSE operating system.

Check that the "audit-audispd-plugins" package is installed on the SUSE operating system with the following command:

# zypper se audit-audispd-plugins

If the "audit-audispd-plugins" package is not installed, this is a finding.

Verify the "au-remote" plugin is enabled with the following command:

# grep -i active /etc/audisp/plugins.d/au-remote.conf
active = yes

If "active" is missing, commented out, or is not set to "yes", this is a finding.

Vulnerability Number

V-217197

Documentable

False

Rule Version

SLES-12-020070

Severity Override Guidance

Verify that the "audit-audispd-plugins" package is installed on the SUSE operating system.

Check that the "audit-audispd-plugins" package is installed on the SUSE operating system with the following command:

# zypper se audit-audispd-plugins

If the "audit-audispd-plugins" package is not installed, this is a finding.

Verify the "au-remote" plugin is enabled with the following command:

# grep -i active /etc/audisp/plugins.d/au-remote.conf
active = yes

If "active" is missing, commented out, or is not set to "yes", this is a finding.

Check Content Reference

M

Target Key

4033

Comments