OpenControls Logo

STIG Viewer

STIGViewer Support

AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect the files within /etc/sudoers.d/

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-269135ALMA-09-006070SV-269135r1050017_ruleCCI-000018medium
Description
Audit records provide a means to investigate events related to a security incident. Insufficient audit coverage will make identifying those responsible challenging or impossible. This auditd policy will watch for and alert the system administrators regarding any modifications to the files within "/etc/sudoers.d/" such as adding privileged users, groups, or commands. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221
STIGDate
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide2026-02-27

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-15.4Automated Audit Actions
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (49) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-16Security and Privacy Attributes
1.00
AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(3)Mandatory Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+39 more (top 10 by confidence shown)

CCI1 mapping
CCI-000018
1.00

Details

Check Text (C-269135r1050017_chk)

Verify AlmaLinux OS 9 generates audit records for all account creations, modifications, disabling, and termination events that affect the files within "/etc/sudoers.d/", with the following command: $ grep /etc/sudoers.d/ /etc/audit/audit.rules -w /etc/sudoers.d/ -p wa -k identity If the command does not return a line or the line is commented out, this is a finding. Note: The "-k" allows for specifying an arbitrary identifier, and the string after it does not need to match the example output above.

Fix Text (F-73067r1049169_fix)

Configure AlmaLinux OS 9 to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/. Add the following to the "/etc/audit/rules.d/audit.rules" file: -w /etc/sudoers.d/ -p wa -k identity Merge the rules into /etc/audit/audit.rules: $ augenrules --load Reboot the server so the changes to take effect.