SV-274105r1120661: Amazon Linux 2023 must audit all successful/unsuccessful uses of the chage command. | Amazon Linux 2023 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Amazon Linux 2023 must audit all successful/unsuccessful uses of the chage command.

Description

Discussion Text

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000130Not mappedCCI-000135Not mappedCCI-000169Not mappedCCI-002884Not mappedCCI-000172

References

DPMS Target Amazon Linux 2023 DISA DPMS Target Amazon Linux 2023 5700

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.amzlx23os:def:274105
# Amazon Linux 2023 must audit all successful/unsuccessful uses of the chage command.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# Audit invocations of /usr/bin/chage
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  grep -Pq '^\s*-a\s+(always,exit|exit,always)(?:\s+-S\s+all)?\s+-F\s+path=/usr/bin/chage\s+(-F\s+perm=([rwa]*x[rwa]*)\s+)?-F\s+auid>=1000\s+-F\s+auid!=(4294967295|-1|unset)(\s+(-k\s+|-F\s+key=)\S+)?\s*$' '/etc/audit/audit.rules' &>/dev/null
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# DISA STIG / SCAP compliance check for Amazon Linux 2023 auditing chage command usage
FILEPATH="/etc/audit/rules.d/audit.rules"
PATTERN="^\\s*-a\\s+(always,exit|exit,always)(?:\\s+-S\\s+all)?\\s+-F\\s+path=/usr/bin/chage\\s+(-F\\s+perm=([rwa]*x[rwa]*)\\s+)?-F\\s+auid>=1000\\s+-F\\s+auid != (4294967295|-1|unset)(\\s+(-k\\s+|-F\\s+key=)\\S+)?\\s*$"
if [ ! -f "$FILEPATH" ]; then echo "PASS"; exit 0; fi
if grep -q "$PATTERN" "$FILEPATH"; then echo "PASS"; exit 0; else echo "FAIL"; exit 1; fi

Remediation

Configure Amazon Linux 2023 so that the audit service generates an audit event for any successful/unsuccessful uses of the "chage" command by adding or updating the following rule in the "/etc/audit/rules.d/audit.rules" file:

-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage

To load the rules to the kernel immediately, use the following command: 

$ sudo augenrules --load