GEN002752 - The audit system must be configured to audit account disabling.

Information

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Solution

Configure execute auditing of the passwd executable. Add the following to the audit.rules file:
-w /usr/bin/passwd -p x -k passwd

Restart the auditd service.

See Also

http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(4), CAT|III, CCI|CCI-001404, Group-ID|V-22378, Rule-ID|SV-26521r1_rule, STIG-ID|GEN002752, Vuln-ID|V-22378

Plugin: Unix

Control ID: 569937cf2935b51b6a636ca2affaddd2192de4067d271edf6d4728427fe43f32