Skip to content
Log In

Ensure the audit Subsystem is Installed

An XCCDF Rule

Description

The audit package should be installed.

Rationale

The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.

ID
xccdf_org.ssgproject.content_rule_package_audit_installed
Severity
Medium
References
Updated

Remediation Templates

Anaconda Pre-Install Instructions

package --add=audit

A Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
if ! rpm -q --quiet "audit" ; then
    yum install -y "audit"
fi

OS Build Blueprint

[[packages]]
name = "audit"
version = "*"

A Puppet Snippet

include install_audit
class install_audit {
  package { 'audit':
    ensure => 'installed',
  }
}

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AU-12(2)