STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS must initiate session audits at system startup.

DISA Rule

SV-270676r1155245_rule

Vulnerability Number

V-270676

Group Title

SRG-OS-000254-GPOS-00095

Rule Version

UBTU-24-102010

Severity

CAT II

CCI(s)

CCI-001464 - Initiates session audits automatically at system start-up.

Weight

Fix Recommendation

Configure Ubuntu 24.04 LTS to produce audit records at system startup.

Edit the "/etc/default/grub" file and add "audit=1" to the "GRUB_CMDLINE_LINUX" option and to the "GRUB_CMDLINE_LINUX_DEFAULT" option.

GRUB_CMDLINE_LINUX_DEFAULT="audit=1"
GRUB_CMDLINE_LINUX="audit=1"

To update the grub config file, run:

$ sudo update-grub

Check Contents

Verify Ubuntu 24.04 LTS enables auditing at system startup in GRUB.

Check the main GRUB defaults to ensure that auditing is enabled:
$ sudo grep -ir GRUB_CMDLINE_LINUX /etc/default/grub
/etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT="audit=1"
/etc/default/grub:GRUB_CMDLINE_LINUX="audit=1"

If any linux lines do not contain "audit=1", this is a finding.

Check the generated GRUB configuration to ensure that the setting is propagated to the bootloader:
$ sudo grep "^\s*linux" /boot/grub/grub.cfg
linux /vmlinuz-6.8.0-31-generic root=UUID=c92a542f-aee4-4af9-94b2-203624ccb8e3 ro audit=1 quiet splash $vt_handoff
linux /vmlinuz-6.8.0-31-generic root=UUID=c92a542f-aee4-4af9-94b2-203624ccb8e3 ro recovery nomodeset dis_ucode_ldr audit=1

If any linux lines do not contain "audit=1", this is a finding.

Note: Output details may vary by system.

Vulnerability Number

V-270676

Documentable

False

Rule Version

UBTU-24-102010

Severity Override Guidance

Check Content Reference

Target Key

5673