RHEL 9 must label all offloaded audit logs before sending them to the central log server.

STIG ID: RHEL-09-653060  |  SRG: SRG-OS-000039-GPOS-00017 |  Severity: medium |  CCI: CCI-000132,CCI-001851 |  Vulnerability Id: V-258161 | 

Vulnerability Discussion

Enriched logging is needed to determine who, what, and when events occur on a system. Without this, determining root cause of an event will be much more difficult.

When audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system.

Satisfies: SRG-OS-000039-GPOS-00017, SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

Check

Verify that RHEL 9 Audit Daemon is configured to label all offloaded audit logs, with the following command:

$ sudo grep name_format /etc/audit/auditd.conf

name_format = hostname

If the "name_format" option is not "hostname", "fqd", or "numeric", or the line is commented out, this is a finding.

Fix

Edit the /etc/audit/auditd.conf file and add or update the "name_format" option:

name_format = hostname

The audit daemon must be restarted for changes to take effect.
This website is not created by, run, approved, or endorsed by the U.S. Department of Defense. Use at your own risk. This website is created by open-source software.