Details
Once an attacker establishes initial access to a system, they often attempt to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply modify an existing account.
Application servers have the capability to contain user information in a local user store, or they can leverage a centralized authentication mechanism like LDAP. Either way, the mechanism used by the application server must automatically log when user accounts are modified.
Solution
1. Access AC
2. From ‘Domain Structure’, select ‘Security Realms’
3. Select realm to configure (default is ‘myrealm’)
4. Select ‘Providers’ tab -> ‘Auditing’ tab
5. Utilize ‘Change Center’ to create a new change session
6. Click ‘New’. Enter a value in ‘Name’ field and select an auditing provider type (ex: DefaultAuditor) in the ‘Type’ dropdown. Click ‘OK’.
7. From ‘Domain Structure’, select the top-level domain link
8. Click ‘Advanced’ near the bottom of the page
9. Set ‘Configuration Audit Type’ dropdown to ‘Change Log and Audit’
10. Click ‘Save’, and from ‘Change Center’ click ‘Activate Changes’ to enable configuration changes
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.
References
- 800-53|AC-2(4)
- CAT|II
- CCI|CCI-001403
- Rule-ID|SV-235934r628580_rule
- STIG-ID|WBLC-01-000019
- STIG-Legacy|SV-70471
- STIG-Legacy|V-56217
- Vuln-ID|V-235934