Oracle Linux 6 Security Technical Implementation Guide

The Oracle Linux 6 Security Technical Implementation Guide (V2 R7) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

267STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Thu Jan 26 2023

The operating system must automatically audit account modification.

Oracle Linux 6 Security Technical Implementation Guide

Assessment Title

Rule Text

The operating system must automatically audit account modification.

Description

Discussion Text

In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-208888

Rule

SV-208888r793673_rule

Severity

low

Rule Version

OL6-00-000175

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

To determine if the system is configured to audit account changes, run the following command:

$sudo egrep -w '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)' /etc/audit/audit.rules

If the system is configured to watch for account changes, lines should be returned for each file specified (and with "-p wa" for each).

If the system is not configured to audit account changes, this is a finding.

Implementation Procedure

Fix Text

Add the following to "/etc/audit/audit.rules", in order to capture events that modify account changes: 

# audit_account_changes
-w /etc/group -p wa -k audit_account_changes
-w /etc/passwd -p wa -k audit_account_changes
-w /etc/gshadow -p wa -k audit_account_changes
-w /etc/shadow -p wa -k audit_account_changes
-w /etc/security/opasswd -p wa -k audit_account_changes

STIG check 96 of 267 in the Oracle Linux 6 STIG checklist

← Previous · V-208887The operating system must automatically audit account creation.Next · V-208889 →The operating system must automatically audit account disabling actions.