SV-204543r958422: The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command. | Red Hat Enterprise Linux 7 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command.

Description

Discussion Text

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000135Not mappedCCI-000172Not mappedCCI-002884SV-86775V-72151

References

DPMS Target Red Hat Enterprise Linux 7 DISA DPMS Target Red Hat Enterprise Linux 7 2899

Checks

DISA STIG (Manual Reference)

Verify the operating system generates audit records when successful/unsuccessful attempts to use the "unix_chkpwd" command occur.

Check the file system rule in "/etc/audit/audit.rules" with the following command:

$ sudo grep -w "/usr/sbin/unix_chkpwd" /etc/audit/audit.rules

-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd

If the command does not return any output, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel7:def:760
# The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# audit augenrules
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  grep -Pq '^ExecStartPost=\-\/sbin\/augenrules.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit augenrules unix_chkpwd
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  grep -rqP --include='*.rules' '^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=(\/usr)?\/sbin\/unix_chkpwd[\s]+(-F[\s]+perm=([rwa]*x[rwa]*)[\s]+)?-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|-1|unset)[\s]+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$' '/etc/audit/rules.d' &>/dev/null
}
# audit auditctl
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  grep -Pq '^ExecStartPost=\-\/sbin\/auditctl.*$' '/usr/lib/systemd/system/auditd.service' &>/dev/null
}
# audit auditctl unix_chkpwd
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  grep -Pq '^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=(\/usr)?\/sbin\/unix_chkpwd[\s]+(-F[\s]+perm=([rwa]*x[rwa]*)[\s]+)?-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|-1|unset)[\s]+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$' '/etc/audit/audit.rules' &>/dev/null
}

if ( ( test_1 && test_2 ) || ( test_3 && test_4 ) ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# oval:mil.disa.stig.rhel7:def:760

if [ ! -f "/usr/lib/systemd/system/auditd.service" ]; then
    echo "FAIL"
    exit 1
fi

grep -q "^ExecStartPost=-\\/sbin\\/augenrules.*$" /usr/lib/systemd/system/auditd.service || {
    echo "FAIL"
    exit 1
}

if [ ! -f "/etc/audit/rules.d/audit.rules" ]; then
    echo "FAIL"
    exit 1
fi

grep -q "^[\\s]*-a[\\s]+always,exit[\\s]+-F[\\s]+path=(\\/usr)?\\/sbin\\/unix_chkpwd[\\s]+(-F[\\s]+perm=([rwa]*x[rwa]*)[\\s]+)?-F[\\s]+auid>=1000[\\s]+-F[\\s]+auid != (?:4294967295|-1|unset)[\\s]+(-k[\\s]+|-F[\\s]+key=)[\\S]+[\\s]*$" /etc/audit/rules.d/audit.rules || {
    echo "FAIL"
    exit 1
}

echo "PASS"
exit 0

Remediation

Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "unix_chkpwd" command occur.

Add or update the following rule in "/etc/audit/rules.d/audit.rules":

-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd

The audit daemon must be restarted for the changes to take effect.