STIGQter STIGQter: STIG Summary: Canonical Ubuntu 16.04 Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2020: Successful/unsuccessful uses of the mount command must generate an audit record.

DISA Rule

SV-90375r5_rule

Vulnerability Number

V-75695

Group Title

SRG-OS-000037-GPOS-00015

Rule Version

UBTU-16-020380

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "mount" command and syscall occur.

Add or update the following rules in "/etc/audit/rules.d/audit.rules":

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount
-a always,exit -F path=/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount

The audit daemon must be restarted for the changes to take effect:

# sudo systemctl restart auditd.service

Check Contents

Verify the operating system generates audit records when successful/unsuccessful attempts to use the "mount" command and syscall occur.

Check that the following system call is being audited by performing the following series of commands to check the file system rules in "/etc/audit/audit.rules":

# grep -iw "mount" /etc/audit/audit.rules

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount
-a always,exit -F path=/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount

If both the "b32" and "b64" audit rules are not defined for the "mount" syscall, this is a finding.

If all uses of the "mount" command are not being audited, this is a finding.

Vulnerability Number

V-75695

Documentable

False

Rule Version

UBTU-16-020380

Severity Override Guidance

Verify the operating system generates audit records when successful/unsuccessful attempts to use the "mount" command and syscall occur.

Check that the following system call is being audited by performing the following series of commands to check the file system rules in "/etc/audit/audit.rules":

# grep -iw "mount" /etc/audit/audit.rules

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount
-a always,exit -F path=/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount

If both the "b32" and "b64" audit rules are not defined for the "mount" syscall, this is a finding.

If all uses of the "mount" command are not being audited, this is a finding.

Check Content Reference

M

Target Key

3075

Comments