NixOS must generate audit records for all account creations, modifications, disabling, and termination events.

An XCCDF Rule

Description

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000476-GPOS-00221, SRG-OS-000042-GPOS-00020, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000276-GPOS-00106, SRG-OS-000277-GPOS-00107, SRG-OS-000477-GPOS-00222, SRG-OS-000304-GPOS-00121

ID: SV-268167r1039389_rule
Version: ANIX-00-001820
Severity: Medium
References: CCI-000015 CCI-000135 CCI-000172
Updated: about 2 months ago

Remediation Templates

Modify NixOS to generate audit logs on account creations and modifications.

Edit /etc/nixos/configuration.nix and ensure the following options are configured:

 security.audit.rules = [
  "-w /etc/sudoers -p wa -k identity"  "-w /etc/passwd -p wa -k identity"
  "-w /etc/shadow -p wa -k identity"
  "-w /etc/gshadow -p wa -k identity"
  "-w /etc/group -p wa -k identity"
  "-w /etc/security/opasswd -p wa -k identity"
 ];

Rebuild the system with the following command:

$ sudo nixos-rebuild switch

NixOS must generate audit records for all account creations, modifications, disabling, and termination events.

Description

Remediation Templates

A Manual Procedure