ℹ️ The items you can view are limited because you do not have a subscription. Contact us at [email protected] to purchase one.

Group Title

SRG-OS-000032-GPOS-00013

Group ID

V-268453

Rule Version

APPL-15-001002

Rule Title

The macOS system must be configured to audit all login and logout events.

Rule ID

SV-268453r1034299_rule

Rule Severity

● Medium

Rule Weight

10.0

Vuln Discussion

The audit system must be configured to record all attempts to log in and out of the system (lo).

Frequently, an attacker that successfully gains access to a system has only gained access to an account with limited privileges, such as a guest account or service account. The attacker must attempt to change to another user account with normal or elevated privileges to proceed. Auditing both successful and unsuccessful attempts to switch to another user account (by way of monitoring login and logout events) mitigates this risk.

The information system monitors login and logout events.

Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218

Documentable

False

Check Content

Verify the macOS system is configured to audit all login and logout events with the following command:

/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo'

If the result is not "1", this is a finding.

Check System

C-72483r1034297_chk

Fix Reference

F-72384r1034298_fix

Fix Text

Configure the macOS system to audit all login and logout events with the following command:

/usr/bin/grep -qE "^flags.*[^-]lo" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,lo/' /etc/security/audit_control; /usr/sbin/audit -s

A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.

Identities

CCI-000067

Employ automated mechanisms to monitor remote access methods.

• 800-53 :: AC-17 (1)
• 800-53 Rev. 4 :: AC-17 (1)
• 800-53 Rev. 5 :: AC-17 (1)
• 800-53A :: AC-17 (1).1

CCI-000172

Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

• 800-53 :: AU-12 c
• 800-53 Rev. 4 :: AU-12 c
• 800-53 Rev. 5 :: AU-12 c
• 800-53A :: AU-12.1 (iv)

CCI-002884

Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.

• 800-53 Rev. 4 :: MA-4 (1) (a)
• 800-53 Rev. 5 :: MA-4 (1) (a)