← Back to Solaris 11 X86 Security Technical Implementation Guide

V-216041

CAT II (Medium)

The operating system must shut down by default upon audit failure (unless availability is an overriding concern).

Rule ID

SV-216041r1038966_rule

STIG

Solaris 11 X86 Security Technical Implementation Guide

Version

V3R5

CCIs

CCI-000140

Discussion

Continuing to operate a system without auditing working properly can result in undocumented access or system changes.

Check Content

The Audit Configuration profile is required.

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

# pfexec auditconfig -getpolicy | grep ahlt

If the output does not include "ahlt" as an active audit policy, this is a finding.

# pfexec auditconfig -getpolicy | grep active | grep cnt

If the output includes "cnt" as an active audit policy, this is a finding.

Fix Text

The Audit Configuration profile is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this action applies.

Set audit policy to halt and suspend on failure.

# pfexec auditconfig -setpolicy +ahlt
# pfexec auditconfig -setpolicy -cnt