SV-37948r4: The system must be configured to send audit/system records to a remote audit server. | Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must be configured to send audit/system records to a remote audit server.

Description

Discussion Text

System/Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000136

Additional Details

Responsibility

System Administrator

References

DPMS Target Red Hat 5 DISA DPMS Target Red Hat 5 2154

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.rhel11:def:189
# The system must be configured to send audit/system records to a remote audit server.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - textfilecontent54_object (textfilecontent54_test) -- logging to a remote server is enabled: cannot derive an existence probe for this object type

# audit enabled in kernel
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  grep -Pq '^[ 	]+kernel[ 	]*[^#

]*audit=1' '/boot/grub/grub.conf' &>/dev/null
}
# audit to syslog enabled
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^[ 	]*active[ 	]*=[ 	]*([a-z]+)/\1/p' '/etc/audisp/plugins.d/syslog.conf') | grep -qxF 'yes'
}

if ( test_1 && test_2 ); then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# DISA STIG / SCAP compliance check for rule oval:mil.disa.fso.rhel11:def:189


# Check if audit is enabled in kernel
if grep -q "^[ \t]+kernel[ \t]*[^#\n\r]*audit=1" /boot/grub/grub.conf; then
    # Check if audit to syslog is enabled
    if grep -q "^[ \t]*active[ \t]*=[ \t]*yes" /etc/audisp/plugins.d/syslog.conf; then
        # Check if logging to a remote server is enabled
        if grep -q "^\*.*\*[ \t]+[^#\n\r]*@[A-Za-z0-9]" /etc/rsyslog.conf; then
            echo "PASS"
            exit 0
        fi
    fi
fi
echo "FAIL"
exit 1

Remediation

Configure the system to send audit records to a remote server. 

Procedure:
These instructions assume a known remote audit server is available to this system. 
Modify /etc/syslog.conf or /etc/rsyslog.conf to contain a line sending all audit records to a remote audit server. The server is specified by placing an "@" before the DNS name or IP address in the line. 

*.* @<remote audit server>

Edit the "active" line in /etc/audisp/plugins.d/syslog.conf so it shows "active = yes".

Restart audit and syslog:
# service auditd restart
# service syslog restart 
Or:
# service rsyslog restart