Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide

The Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide (V2 R3) has 229 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

229STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R3

CurrentPublished Fri Apr 23 2021

Off-loading audit records to another system must be authenticated.

Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide

Assessment Title

Rule Text

Off-loading audit records to another system must be authenticated.

Description

Discussion Text

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-215041

Rule

SV-215041r610931_rule

Severity

medium

Rule Version

UBTU-16-020080

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the audit system authenticates off-loading audit records to a different system.

Check that the off-loading of audit records to a different system is authenticated with the following command:

# sudo grep enable /etc/audisp/audisp-remote.conf

enable_krb5 = yes

If "enable_krb5" option is not set to "yes" or the line is commented out, this is a finding.

Implementation Procedure

Fix Text

Configure the audit system to authenticate off-loading audit records to a different system.

Uncomment the "enable_krb5" option in "/etc/audisp/audisp-remote.conf" and set it to "yes". See the example below.

enable_krb5 = yes

STIG check 103 of 229 in the Canonical Ubuntu 16.04 LTS STIG checklist

← Previous · V-215040The remote audit system must take appropriate action when audit storage is full.Next · V-215042 →Audit logs must have a mode of 0600 or less permissive to prevent unauthorized read access.