CIS Ubuntu 14.04 LTS - 4.1.1.2 Ensure system is disabled when audit logs are full

Configure auditd to halt the system when audit logs are full to prevent loss of audit data

cyberstrikeus Updated

File contents

4.1.1.2 Ensure system is disabled when audit logs are full (Scored)

Profile Applicability

  • Level 2 - Server
  • Level 2 - Workstation

Description

The auditd daemon can be configured to halt the system when the audit logs are full.

Rationale

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Audit Procedure

Run the following commands and verify output matches:

grep space_left_action /etc/audit/auditd.conf
grep action_mail_acct /etc/audit/auditd.conf
grep admin_space_left_action /etc/audit/auditd.conf

Expected Result

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

Remediation

Set the following parameters in /etc/audit/auditd.conf:

space_left_action = email
action_mail_acct = root
admin_space_left_action = halt

Default Value

Not configured by default.

References

  1. CIS Controls v6.1 - 6.3 Ensure Audit Logging Systems Are Not Subject To Loss

Profile

  • Level 2 - Server
  • Level 2 - Workstation

cyberstrikeus/cyberstrike/tree/main/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-14-04-lts-benchmark-v2/cis-ubuntu1404-v210-4-1-1-2 commit 044ab702c2

Frequently asked questions

npx skillmds@latest add cyberstrikeus/cis-ubuntu-14-04-lts-4-1-1-2-ensure-system-is-disabled-when-