Information
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. To that end, the auditd service must be configured to start automatically and be running at all times.
Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000042-GPOS-00021, SRG-OS-000255-GPOS-00096, SRG-OS-000363-GPOS-00150, SRG-OS-000365-GPOS-00152, SRG-OS-000445-GPOS-00199, SRG-OS-000446-GPOS-00200, SRG-OS-000461-GPOS-00205, SRG-OS-000465-GPOS-00209, SRG-OS-000467-GPOS-00211, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220
Solution
At the command line, execute the following command:
# systemctl enable auditd.service
# service auditd start
Item Details
References: CAT|II, CCI|CCI-000135, CCI|CCI-000169, CCI|CCI-000172, CCI|CCI-001487, CCI|CCI-001744, CCI|CCI-001814, CCI|CCI-002696, CCI|CCI-002699, Rule-ID|SV-239090r856039_rule, STIG-ID|PHTN-67-000018, Vuln-ID|V-239090
Control ID: 10b7bca59eade9ad5337dd07185b3afe1d6a820c2996dd835d3fbceb9103ce80