Ensure the default plugins for the audit dispatcher are Installed
An XCCDF Rule
Description
The audit-audispd-plugins package should be installed.
warning alert: Warning
This package is not available in Red Hat Enterprise Linux 8 [rhel8]. The correct package is called
audispd-plugins.
Rationale
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
- ID
- xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed
- Severity
- Medium
- References
- Updated
Remediation - script:bootc
dnf install audit-audispd-plugins
Remediation - OS Build Blueprint
[[packages]]
name = "audit-audispd-plugins"
version = "*"
Remediation - Puppet
include install_audit-audispd-plugins
class install_audit-audispd-plugins {
package { 'audit-audispd-plugins':
ensure => 'installed',
}
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- PCI-DSS-Req-10.5.3
- PCI-DSSv4-10.3
Remediation - script:kickstart
package install audit-audispd-plugins
Remediation - Anaconda Pre-Install Instructions
package --add=audit-audispd-plugins
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
if ! rpm -q --quiet "audit-audispd-plugins" ; then
yum install -y "audit-audispd-plugins"
fi