SLEM 5 must generate audit records for all uses of the "sudo" command.

An XCCDF Rule

Description

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.

ID: SV-261445r996742_rule
Version: SLEM-05-654110
Severity: Medium
References: CCI-000130 CCI-000135 CCI-000169 CCI-000172 CCI-002884
Updated: 5 days ago

Remediation Templates

Configure SLEM 5 to generate an audit record for all uses of the "sudo" command.

Add or modify the following line in the "/etc/audit/rules.d/audit.rules" file:

-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k privileged-sudo
To reload the rules file, restart the audit daemon:

     > sudo systemctl restart auditd.service

or issue the following command:

     > sudo augenrules --load

SLEM 5 must generate audit records for all uses of the "sudo" command.

Description

Remediation Templates

A Manual Procedure