Oracle Linux 6 Security Technical Implementation Guide

The Oracle Linux 6 Security Technical Implementation Guide (V2 R7) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

267STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Thu Jan 26 2023

Auditing must be enabled at boot by setting a kernel parameter.

Oracle Linux 6 Security Technical Implementation Guide

Assessment Title

Rule Text

Auditing must be enabled at boot by setting a kernel parameter.

Description

Discussion Text

Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although "auditd" takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-209068

Rule

SV-209068r793789_rule

Severity

low

Rule Version

OL6-00-000525

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Inspect the kernel boot arguments (which follow the word "kernel") in "/etc/grub.conf". If they include "audit=1", then auditing is enabled at boot time. 
If auditing is not enabled at boot time, this is a finding.

Implementation Procedure

Fix Text

To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument "audit=1" to the kernel line in "/boot/grub/grub.conf", in the manner below:

kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1

UEFI systems may prepend "/boot" to the "/vmlinuz-version" argument.

STIG check 201 of 267 in the Oracle Linux 6 STIG checklist

← Previous · V-209067The system must provide automated support for account management functions.Next · V-209069 →Automated file system mounting tools must not be enabled unless needed.