Nutanix AOS must initiate session audits at system start-up.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-254163 | NUTX-OS-000610 | SV-254163r846577_rule | Medium |
| Description |
|---|
| If auditing is enabled late in the start-up process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created. |
| STIG | Date |
|---|---|
| Nutanix AOS 5.20.x OS Security Technical Implementation Guide | 2022-08-24 |
Details
| Check Text ( C-57648r846575_chk ) |
|---|
| Determine if auditing is active by issuing the following command: $ sudo systemctl is-active auditd.service active If the "auditd" status is not active, this is a finding. |
| Fix Text (F-57599r846576_fix) |
|---|
| Configure the audit service to be active and start automatically with the system at startup. The Audit service is protected and restricted to allow access or modifications only from the root account. $ sudo su - # systemctl start auditd.service |