Ensure the default plugins for the audit dispatcher are Installed
An XCCDF Rule
Description
The audit-audispd-plugins package should be installed.
Rationale
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
- ID
- xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed
- Severity
- Medium
- References
- Updated
Remediation - OS Build Blueprint
[[packages]]
name = "audit-audispd-plugins"
version = "*"
Remediation - Ansible
- name: Ensure audit-audispd-plugins is installed
package:
name: audit-audispd-plugins
state: present
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
Remediation - Puppet
include install_audit-audispd-plugins
class install_audit-audispd-plugins {
package { 'audit-audispd-plugins':
ensure => 'installed',
}
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
zypper install -y "audit-audispd-plugins"
else