STIGQter STIGQter: STIG Summary: Apple OS X 10.13 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 24 Jan 2020: The macOS system must generate audit records for DoD-defined events such as successful/unsuccessful logon attempts, successful/unsuccessful direct access attempts, starting and ending time for user access, and concurrent logons to the same account from different sources.

DISA Rule

SV-96239r1_rule

Vulnerability Number

V-81525

Group Title

SRG-OS-000470-GPOS-00214

Rule Version

AOSX-13-000200

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To ensure the appropriate flags are enabled for auditing, run the following command:

/usr/bin/sudo /usr/bin/sed -i.bak '/^flags/ s/$/,aa/' /etc/security/audit_control; /usr/bin/sudo /usr/sbin/audit -s

A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.

Check Contents

To view the currently configured flags for the audit daemon, run the following command:

/usr/bin/sudo /usr/bin/grep ^flags /etc/security/audit_control

Logon events are logged by way of the "aa" flag.

If "aa" is not listed in the result of the check, this is a finding.

Vulnerability Number

V-81525

Documentable

False

Rule Version

AOSX-13-000200

Severity Override Guidance

To view the currently configured flags for the audit daemon, run the following command:

/usr/bin/sudo /usr/bin/grep ^flags /etc/security/audit_control

Logon events are logged by way of the "aa" flag.

If "aa" is not listed in the result of the check, this is a finding.

Check Content Reference

M

Target Key

3329

Comments