STIGQter STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

Ubuntu OS must monitor remote access methods.

DISA Rule

SV-275676r1148078_rule

Vulnerability Number

V-275676

Group Title

SRG-OS-000032-GPOS-00013

Rule Version

RIIM-OS-652015

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure Ubuntu OS to monitor all remote access methods.

Add or modify the following line in the "/etc/rsyslog.d/50-default.conf" file:

auth.*,authpriv.* /var/log/secure
daemon.* /var/log/messages

Restart "rsyslog.service" for the changes to take effect by using the following command:

$ sudo systemctl restart rsyslog.service

Check Contents

Verify that Ubuntu OS monitors all remote access methods by using the following command:

$ grep -Er '^(auth\.\*,authpriv\.\*|daemon\.\*)' /etc/rsyslog.*
/etc/rsyslog.d/50-default.conf:auth.*,authpriv.* /var/log/secure
/etc/rsyslog.d/50-default.conf:daemon.* /var/log/messages

If "auth.*", "authpriv.*", or "daemon.*" are not configured to be logged in at least one of the config files, this is a finding.

Vulnerability Number

V-275676

Documentable

False

Rule Version

RIIM-OS-652015

Severity Override Guidance

Verify that Ubuntu OS monitors all remote access methods by using the following command:

$ grep -Er '^(auth\.\*,authpriv\.\*|daemon\.\*)' /etc/rsyslog.*
/etc/rsyslog.d/50-default.conf:auth.*,authpriv.* /var/log/secure
/etc/rsyslog.d/50-default.conf:daemon.* /var/log/messages

If "auth.*", "authpriv.*", or "daemon.*" are not configured to be logged in at least one of the config files, this is a finding.

Check Content Reference

M

Target Key

5706