The audit system must be configured to audit account creation.

An XCCDF Rule

Details
Profiles

Description

Without auditing, malicious activity cannot be detected.

ID: SV-216024r958368_rule
Version: SOL-11.1-010230
Severity: Medium
References: CCI-000018
Updated: about 2 months ago

Remediation Templates

The Audit Configuration profile is required. All audit flags must be enabled in a single command.

This action applies to the global zone only. Determine the zone currently being secured.

# zonename
If the command output is  "global ", this action applies.

For Solaris 11, 11.1, 11.2, and 11.3:
# pfexec auditconfig -setflags cusa,-ps,fd,-fa,fm

For Solaris 11.4 or newer:
# pfexec auditconfig -setflags cusa,-fa,-ex,-ps,fd,fm

Enable the audit policy to collect command line arguments.

# pfexec auditconfig -setpolicy +argv

These changes will not affect users that are currently logged in.

The audit system must be configured to audit account creation.

Description

Remediation Templates

A Manual Procedure