ℹ️ The items you can view are limited because you do not have a subscription. Contact us at [email protected] to purchase one.

Group Title

SRG-OS-000032-GPOS-00013

Group ID

V-259453

Rule Version

APPL-14-001002

Rule Title

The macOS system must be configured to audit all log on and log out events.

Rule ID

SV-259453r958406_rule

Rule Severity

● Medium

Rule Weight

10.0

Vuln Discussion

The audit system must be configured to record all attempts to log in and out of the system (lo).

Frequently, an attacker that successfully gains access to a system has only gained access to an account with limited privileges, such as a guest account or a service account. The attacker must attempt to change to another user account with normal or elevated privileges in order to proceed. Auditing both successful and unsuccessful attempts to switch to another user account (by way of monitoring log on and log out events) mitigates this risk.

The information system monitors log on and log out events.

Satisfies: SRG-OS-000032-GPOS-00013,SRG-OS-000064-GPOS-00033,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000471-GPOS-00216,SRG-OS-000472-GPOS-00217,SRG-OS-000473-GPOS-00218

Documentable

False

Check Content

Verify the macOS system is configured to audit all log on and log out events with the following command:

/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo'

If the result is not "1", this is a finding.

Check System

C-63192r940979_chk

Fix Reference

F-63100r940980_fix

Fix Text

Configure the macOS system to audit all log on and log out events with the following command:

/usr/bin/grep -qE "^flags.*[^-]lo" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,lo/' /etc/security/audit_control; /usr/sbin/audit -s

A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.

Identities

CCI-000067

Employ automated mechanisms to monitor remote access methods.

• 800-53 :: AC-17 (1)
• 800-53 Rev. 4 :: AC-17 (1)
• 800-53 Rev. 5 :: AC-17 (1)
• 800-53A :: AC-17 (1).1

CCI-000172

Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

• 800-53 :: AU-12 c
• 800-53 Rev. 4 :: AU-12 c
• 800-53 Rev. 5 :: AU-12 c
• 800-53A :: AU-12.1 (iv)

CCI-002884

Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.

• 800-53 Rev. 4 :: MA-4 (1) (a)
• 800-53 Rev. 5 :: MA-4 (1) (a)