STIGQter STIGQter: STIG Summary: Oracle Linux 5 Security Technical Implementation Guide Version: 1 Release: 13 Benchmark Date: 26 Oct 2018: The system must log informational authentication data.

DISA Rule

SV-64229r2_rule

Vulnerability Number

V-12004

Group Title

GEN003660

Rule Version

GEN003660

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Edit /etc/syslog.conf or /etc/rsyslog.conf and add local log destinations for "authpriv.*", "authpriv.debug" or "authpriv.info".

Check Contents

Depending on what system is used for log processing either /etc/syslog.conf or /etc/rsyslog.conf will be the logging configuration file.

Check /etc/syslog.conf or /etc/rsyslog.conf and verify the authpriv facility is logging both the "notice" and "info" priority messages.

Procedure:

For a given action all messages of a higher severity or "priority" are logged. The three lowest priorities in ascending order are "debug", "info" and "notice". A priority of "info" will include "notice". A priority of "debug" includes both "info" and "notice".

Enter/Input for syslog:

# grep "authpriv.debug" /etc/syslog.conf
# grep "authpriv.info" /etc/syslog.conf
# grep "authpriv\.\*" /etc/syslog.conf

Enter/Input for rsyslog:

# grep "authpriv.debug" /etc/rsyslog.conf
# grep "authpriv.info" /etc/rsyslog.conf
# grep "authpriv\.\*" /etc/rsyslog.conf

If an "authpriv.*", "authpriv.debug", or "authpriv.info" entry is not found, this is a finding.

Vulnerability Number

V-12004

Documentable

False

Rule Version

GEN003660

Severity Override Guidance

Depending on what system is used for log processing either /etc/syslog.conf or /etc/rsyslog.conf will be the logging configuration file.

Check /etc/syslog.conf or /etc/rsyslog.conf and verify the authpriv facility is logging both the "notice" and "info" priority messages.

Procedure:

For a given action all messages of a higher severity or "priority" are logged. The three lowest priorities in ascending order are "debug", "info" and "notice". A priority of "info" will include "notice". A priority of "debug" includes both "info" and "notice".

Enter/Input for syslog:

# grep "authpriv.debug" /etc/syslog.conf
# grep "authpriv.info" /etc/syslog.conf
# grep "authpriv\.\*" /etc/syslog.conf

Enter/Input for rsyslog:

# grep "authpriv.debug" /etc/rsyslog.conf
# grep "authpriv.info" /etc/rsyslog.conf
# grep "authpriv\.\*" /etc/rsyslog.conf

If an "authpriv.*", "authpriv.debug", or "authpriv.info" entry is not found, this is a finding.

Check Content Reference

M

Responsibility

System Administrator

Target Key

2207

Comments