SV-90457r5_rule
V-75777
SRG-OS-000037-GPOS-00015
UBTU-16-020760
CAT II
10
Configure the audit system to generate an audit event for any successful/unsuccessful uses of the "passwd" command.
Add or update the following rule in the "/etc/audit/audit.rules" file:
-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd
The audit daemon must be restarted for the changes to take effect. To restart the audit daemon, run the following command:
# sudo systemctl restart auditd.service
Verify that an audit event is generated for any successful/unsuccessful use of the "passwd" command.
Check for the following system call being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
# sudo grep -w passwd /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd
If the command does not return a line, or the line is commented out, this is a finding.
V-75777
False
UBTU-16-020760
Verify that an audit event is generated for any successful/unsuccessful use of the "passwd" command.
Check for the following system call being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
# sudo grep -w passwd /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd
If the command does not return a line, or the line is commented out, this is a finding.
M
3075