TOSS 5 audit system must protect login user identifiers (UIDs) from unauthorized change.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-282434 | TOSS-05-000463 | SV-282434r1200282_rule | CCI-000162 | medium |
| Description | ||||
| If modification of login UIDs is not prevented, they can be changed by nonprivileged users and make auditing complicated or impossible. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000462-GPOS-00206, SRG-OS-000475-GPOS-00220 | ||||
| STIG | Date | |||
| Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide | 2026-04-01 | |||
Details
Check Text (C-282434r1200282_chk)
Verify the audit system prevents unauthorized changes to login UIDs using the following command:
$ sudo grep -i immutable /etc/audit/audit.rules
--loginuid-immutable
If the "--loginuid-immutable" option is not returned in the "/etc/audit/audit.rules", or the line is commented out, this is a finding.
Fix Text (F-86900r1200281_fix)
Configure TOSS 5 auditing to prevent modification of login UIDs once they are set by adding the following line to "/etc/audit/rules.d/audit.rules":
--loginuid-immutable
Restart the audit daemon for the changes to take effect.