SV-217197r958754: The audit-audispd-plugins must be installed on the SUSE operating system. | SUSE Linux Enterprise Server 12 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The audit-audispd-plugins must be installed on the SUSE operating system.

Description

Discussion Text

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001851SV-91997V-77301

References

DPMS Target SUSE Linux Enterprise Server 12 DISA DPMS Target SUSE Linux Enterprise Server 12 4033

Checks

DISA STIG (Manual Reference)

Verify that the "audit-audispd-plugins" package is installed on the SUSE operating system. 

Check that the "audit-audispd-plugins" package is installed on the SUSE operating system with the following command:

# zypper se audit-audispd-plugins

If the "audit-audispd-plugins" package is not installed, this is a finding.

Verify the "au-remote" plugin is enabled with the following command: 

# grep -i active /etc/audisp/plugins.d/au-remote.conf 
active = yes

If "active" is missing, commented out, or is not set to "yes", this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.sles12:def:160
# The audit-audispd-plugins must be installed on the SUSE operating system.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# audit-audispd-plugins package is installed
# rpminfo_object (rpminfo_test)
test_1() {
  rpm -q --quiet 'audit-audispd-plugins' &>/dev/null
}
# au-remote plugin is enabled
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^\s*active\s*=\s*([^#\n]+)(?:#.*|\s*)$/\1/p' '/etc/audisp/plugins.d/au-remote.conf') | grep -qxF 'yes'
}

if ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Install the "audit-audispd-plugins" package on the SUSE operating system by running the following command:

# sudo zypper install audit-audispd-plugins

In /etc/audisp/plugins.d/au-remote.conf, change the value of "active" to "yes", or add "active = yes" if no such setting exists in the file.