Oracle Linux 6 Security Technical Implementation Guide

The Oracle Linux 6 Security Technical Implementation Guide (V2 R7) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

267STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Thu Jan 26 2023

The operating system must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event.

Oracle Linux 6 Security Technical Implementation Guide

Assessment Title

Rule Text

The operating system must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event.

Description

Discussion Text

Ensuring the "auditd" service is active ensures audit records generated by the kernel can be written to disk, or that appropriate actions will be taken if other obstacles exist.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-208875

Rule

SV-208875r793660_rule

Severity

medium

Rule Version

OL6-00-000145

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Run the following command to determine the current status of the "auditd" service: 

# service auditd status

If the service is enabled, it should return the following: 

auditd is running...

If the service is not running, this is a finding.

Implementation Procedure

Fix Text

The "auditd" service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The "auditd" service can be enabled with the following commands: 

# chkconfig auditd on
# service auditd start

STIG check 83 of 267 in the Oracle Linux 6 STIG checklist

← Previous · V-208874System logs must be rotated daily.Next · V-208876 →The operating system must employ automated mechanisms to facilitate the monitoring and control of remote access methods.