STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025: STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:SV-275712r1148186_rule
V-275712
SRG-OS-000064-GPOS-00033
RIIM-OS-654125
CAT II
10
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "usermod" command.
Add or modify the following line in the "/etc/audit/rules.d/stig.rules" file:
-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod
To reload the rules file, issue the following command:
$ sudo augenrules --load
Note: The "-k <keyname>" at the end of the line gives the rule a unique meaning to help during an audit investigation. The <keyname> does not need to match the example above.
Verify an audit event is generated for any successful/unsuccessful use of the "usermod" command by using the following command:
$ sudo auditctl -l | grep -w usermod
-a always,exit -S all -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-usermod
If the command does not return a line that matches the example or the line is commented out, this is a finding.
Note: The "key=" value is arbitrary and can be different from the example output above.
V-275712
False
RIIM-OS-654125
Verify an audit event is generated for any successful/unsuccessful use of the "usermod" command by using the following command:
$ sudo auditctl -l | grep -w usermod
-a always,exit -S all -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=-1 -F key=privileged-usermod
If the command does not return a line that matches the example or the line is commented out, this is a finding.
Note: The "key=" value is arbitrary and can be different from the example output above.
M
5706