STIGQter STIGQter: STIG Summary: SLES 12 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The SUSE operating system must generate audit records for all uses of the kmod command.

DISA Rule

SV-217217r603262_rule

Vulnerability Number

V-217217

Group Title

SRG-OS-000037-GPOS-00015

Rule Version

SLES-12-020360

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the SUSE operating system to audit the execution of the module management program "kmod" by adding the following line to "/etc/audit/rules.d/audit.rules":

-w /usr/bin/kmod -p x -k modules

The audit daemon must be restarted for any changes to take effect.

# sudo systemctl restart auditd.service

Check Contents

Verify the SUSE operating system generates an audit record for all uses of the "kmod" command.

Check that the following command call is being audited by performing the following command on the system rules in "/etc/audit/audit.rules":

# sudo grep kmod /etc/audit/audit.rules

-w /usr/bin/kmod -p x -k modules

If the system is configured to audit the execution of the module management program "kmod", the command will return a line.

If the command does not return a line, or the line is commented out, this is a finding.

Vulnerability Number

V-217217

Documentable

False

Rule Version

SLES-12-020360

Severity Override Guidance

Verify the SUSE operating system generates an audit record for all uses of the "kmod" command.

Check that the following command call is being audited by performing the following command on the system rules in "/etc/audit/audit.rules":

# sudo grep kmod /etc/audit/audit.rules

-w /usr/bin/kmod -p x -k modules

If the system is configured to audit the execution of the module management program "kmod", the command will return a line.

If the command does not return a line, or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

4033

Comments