Detections
Analytics
SOL-11.1-010350 - The operating system must protect against an individual falsely denying having performed a particular action. In order to do so the system must be configured to send audit records to a remote audit server - 'getplugin'
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
Keeping audit records on a remote system reduces the likelihood of audit records being changed or corrupted. Duplicating and protecting the audit trail on a separate system reduces the likelihood of an individual being able to deny performing an action.Solaris has supported rsyslog since version 11.1 and the differences between syslog and rsyslog are numerous. Solaris 11.4 installs rsyslog by default, but previous versions require a manual installation. When establishing a rsyslog server to forward to, it is important to consider the network requirements for this action. Note the following configuration options:
There are three ways to forward message: the traditional UDP transport, which is extremely lossy but standard; the plain TCP based transport, which loses messages only during certain situations but is widely available; and the RELP transport, which does not lose messages but is currently available only as part of the rsyslogd 3.15.0 and above.
Examples of each configuration:
UDP *.* @remotesystemname
TCP *.* @@remotesystemname
RELP *.* :omrelp:remotesystemname:2514
Please note that a port number was given as there is no standard port for RELP.
Solution
Service Management, Audit Configuration and Audit Control rights profile is required.This action applies to the global zone only. Determine the zone that you are currently securing.
# zonename
If the command output is 'global', this action applies.
Configure Solaris 11 to use the syslog audit plugin
# pfexec auditconfig -setplugin audit_syslog active
Determine which system-log service instance is online.
# pfexec svcs system-log
If the default system-log service is online:
# pfedit /etc/syslog.conf
Add the line:
audit.notice @[remotesystemname]
or
audit.notice ![remotesystemname]
Replacing the remote system name with the correct hostname.
If the rsyslog service is online, modify the /etc/rsyslog.conf file.
# pfedit /etc/rsyslog.conf
Add the line:
*.* @@[remotesystemname]
Or
*.* :omrelp:[remotesystemname]:[designatedportnumber]
Replacing the remote system name with the correct hostname.
Create the log file on the remote system
# touch /var/adm/auditlog
Refresh the syslog service
# pfexec svcadm refresh system/system-log:default
or
# pfexec svcadm refresh system/system-log:rsyslog
Refresh the audit service
# pfexec audit -s
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_11_SPARC_V2R2_STIG.zip
Item Details
Audit Name: DISA STIG Solaris 11 SPARC v2r2
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-12, CAT|III, CCI|CCI-000166, Rule-ID|SV-216269r603267_rule, STIG-ID|SOL-11.1-010350, STIG-Legacy|SV-60703, STIG-Legacy|V-47827, Vuln-ID|V-216269
Plugin: Unix
Control ID: 8e31da27e82804be26a1d10a7c9dfb939b60cadfeef273aba3681083f7ea4c10