V-285660

Discussion

Audit records provide visibility into activities affecting system security, user accountability, and operating system integrity. Failure to audit security-relevant events may prevent administrators from detecting unauthorized activity, privilege misuse, policy violations, or attempts to compromise system resources. Without sufficient audit coverage, critical actions including account modification, privilege escalation, security object modification, and execution of privileged commands may occur without generating records necessary for monitoring or forensic analysis. The operating system must generate audit records for defined security-relevant events to support monitoring, incident investigation, and accountability requirements. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00020, SRG-OS-000042-GPOS-00021, SRG-OS-000062-GPOS-00031, SRG-OS-000063-GPOS-00032, SRG-OS-000064-GPOS-00033, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000303-GPOS-00120, SRG-OS-000327-GPOS-00127, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00211, SRG-OS-000468-GPOS-00212, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000476-GPOS-00221, SRG-OS-000477-GPOS-00222, SRG-OS-000358-GPOS-00145, SRG-OS-000358-GPOS-00146

Check Content

Verify Harvester Government is configured to generate audit records for required security-relevant events.

1. Access Harvester Government using a privileged account and verify the audit rules file exists:

ls -l /etc/audit/rules.d/audit.rules

If "/etc/audit/rules.d/audit.rules" does not exist, this is a finding.

2. Review the configured audit rules:

grep -v '^#' /etc/audit/rules.d/audit.rules

3. Verify audit rules exist for the following event categories:

Account and identity events:
- account creation, modification, and deletion
- authentication and logon events
- /etc/passwd
- /etc/group
- /etc/shadow

Privileged activities:
- sudo
- sudoedit
- su
- passwd
- usermod
- privilege escalation events

Permission and security object modifications:
- chmod
- chown
- setxattr
- file deletion and rename operations

Kernel and system configuration events:
- kernel module loading and unloading
- mount and unmount operations

Access control and failed access attempts:
- permission denied events
- unauthorized file access attempts

Container runtime events:
- containerd
- runc
- ctr
- crictl

4. At a minimum, verify audit entries similar to the following are present:
-w /etc/passwd -p wa -k account_mod
-w /etc/group -p wa -k account_mod
-a always,exit -F path=/usr/bin/sudo -F perm=x -k privileged-sudo
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S mount -k privileged-mount

If required audit categories, privileged command monitoring, account monitoring, kernel module monitoring, or security object audit rules are absent, disabled, or modified from the approved baseline, this is a finding.