Cis Ubuntu2004 V300 6 3 1 2

6.3.1.2 Ensure auditd service is enabled and active (Automated)

Profile

• Level 2 - Server
• Level 2 - Workstation

Description

Turn on the auditd daemon to record system events.

Rationale

The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.

Audit Procedure

Command Line

Run the following command to verify auditd is enabled:

# systemctl is-enabled auditd | grep '^enabled'
enabled

Verify result is "enabled".

Run the following command to verify auditd is active:

# systemctl is-active auditd | grep '^active'
active

Verify result is "active".

Expected Result

auditd should be enabled and active.

Remediation

Command Line

Run the following commands to unmask, enable and start auditd:

# systemctl unmask auditd
# systemctl enable auditd
# systemctl start auditd

References

1. NIST SP 800-53 Rev. 5: AU-2, AU-12, SI-5
2. STIG ID: UBTU-20-010182 | RULE ID: SV-238298r958506 | CAT II
3. STIG ID: UBTU-22-653015 | RULE ID: SV-260591r1015023 | CAT II

CIS Controls

MITRE ATT&CK Mappings: T1562, T1562.001 / TA0005 / M1028