UCF STIG Viewer Logo

The audit system must be configured to audit changes to the /etc/sudoers file.


Overview

Finding ID Version Rule ID IA Controls Severity
V-38578 RHEL-06-000201 SV-50379r1_rule Low
Description
The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2015-05-26

Details

Check Text ( C-46136r1_chk )
To verify that auditing is configured for system administrator actions, run the following command:

# auditctl -l | grep "watch=/etc/sudoers"


If there is no output, this is a finding.
Fix Text (F-43526r1_fix)
At a minimum, the audit system should collect administrator actions for all users and root. Add the following to "/etc/audit/audit.rules":

-w /etc/sudoers -p wa -k actions