V-285664

Discussion

Improperly configured audit subsystem settings may result in loss of audit records, failure to detect audit processing issues, or inability to preserve security-relevant events during resource exhaustion conditions. Configuring audit processing and failure handling parameters ensures audit records remain available to support monitoring, accountability, and forensic analysis. Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000055-GPOS-00026, SRG-OS-000275-GPOS-00105, SRG-OS-000276-GPOS-00106, SRG-OS-000277-GPOS-00107

Check Content

Verify the Harvester Government audit configuration files are protected from unauthorized access and configured to preserve audit processing integrity.

1. As a privileged user, run the following command on the Harvester node:

stat -c "%n %a %U %G" /etc/audit/auditd.conf /etc/audit/rules.d/audit.rules

2. Verify the output shows:

/etc/audit/auditd.conf 600 root root
/etc/audit/rules.d/audit.rules 640 root root

If either file does not exist, is not owned by root:root, or does not have the required permissions, this is a finding.

3. Verify the audit daemon configuration with the following commands:

grep -E "^(max_log_file_action|space_left_action|admin_space_left_action|disk_full_action|action_mail_acct|log_format)" /etc/audit/auditd.conf

4. Verify the following values are configured:

log_format = RAW
max_log_file_action = ROTATE
space_left_action = SYSLOG
action_mail_acct = root
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND

(Audit records are rotated rather than overwritten.
Low audit storage conditions generate notification events.
Administrative low-space conditions suspend processing.
Disk-full conditions suspend audit activity.
Audit notifications are sent to an approved administrative account.
Audit records are generated in the approved format.)

If any setting is missing, commented out, or configured with a value other than the expected value, this is a finding.