STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025: STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:SV-275701r1148153_rule
V-275701
SRG-OS-000064-GPOS-00033
RIIM-OS-654070
CAT II
10
Configure the audit system to generate an audit event for any successful/unsuccessful use of the "newgrp" command.
Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file:
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd
To reload the rules file, issue the following command:
$ sudo augenrules --load
Note: The "-k <keyname>" at the end of the line gives the rule a unique meaning to help during an audit investigation. The <keyname> does not need to match the example above.
Verify Ubuntu OS generates an audit record upon successful/unsuccessful attempts to use the "newgrp" command by using the following command:
$ sudo auditctl -l | grep newgrp
-a always,exit -S all -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cmd
If the command does not return a line that matches the example or the line is commented out, this is a finding.
Note: The "key=" value is arbitrary and can be different from the example output above.
V-275701
False
RIIM-OS-654070
Verify Ubuntu OS generates an audit record upon successful/unsuccessful attempts to use the "newgrp" command by using the following command:
$ sudo auditctl -l | grep newgrp
-a always,exit -S all -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=-1 -F key=priv_cmd
If the command does not return a line that matches the example or the line is commented out, this is a finding.
Note: The "key=" value is arbitrary and can be different from the example output above.
M
5706