Details

If auditing is enabled late in the boot process, the actions of startup scripts may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.

Solution

Edit the grub bootloader file /boot/grub/grub.conf or /boot/grub/menu.lst by appending the ‘audit=1’ parameter to the kernel boot line.
Reboot the system for the change to take effect.

Supportive Information

The following resource is also helpful.

• http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-6b.
• CAT|III
• CCE|CCE-15026-8, CCI|CCI-000366
• Group-ID|V-22598
• Rule-ID|SV-27001r1_rule
• STIG-ID|GEN000000-LNX00720
• Vuln-ID|V-22598

Source

• Tenable.com/audits