cyberstrikeus 6.3.2.3 Ensure system is disabled when audit logs are full (Automated)
Profile
- Level 2 - Server
- Level 2 - Workstation
Description
The auditd daemon can be configured to halt the system or put the system in single user mode, if no free space is available or an error is detected on the partition that holds the audit log files.
The disk_full_action parameter tells the system what action to take when no free space is available on the partition that holds the audit log files. Valid values are ignore, syslog, rotate, exec, suspend, single, and halt.
The disk_error_action parameter tells the system what action to take when an error is detected on the partition that holds the audit log files. Valid values are ignore, syslog, exec, suspend, single, and halt.
Rationale
In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.
Impact
disk_full_action parameter:
- Set to
halt- theauditddaemon will shutdown the system when the disk partition containing the audit logs becomes full. - Set to
single- theauditddaemon will put the computer system in single user mode when the disk partition containing the audit logs becomes full.
disk_error_action parameter:
- Set to
halt- theauditddaemon will shutdown the system when an error is detected on the partition that holds the audit log files. - Set to
single- theauditddaemon will put the computer system in single user mode when an error is detected on the partition that holds the audit log files. - Set to
syslog- theauditddaemon will issue no more than 5 consecutive warnings to syslog when an error is detected on the partition that holds the audit log files.
Audit Procedure
Command Line
Run the following command and verify the disk_full_action is set to either halt or single:
# grep -Pi -- '^\h*disk_full_action\h*=\h*(halt|single)\b' /etc/audit/auditd.conf
disk_full_action = <halt|single>
Run the following command and verify the disk_error_action is set to syslog, single, or halt:
# grep -Pi -- '^\h*disk_error_action\h*=\h*(syslog|single|halt)\b' /etc/audit/auditd.conf
disk_error_action = <syslog|single|halt>
Expected Result
disk_full_action should be set to halt or single. disk_error_action should be set to syslog, single, or halt.
Remediation
Command Line
Set one of the following parameters in /etc/audit/auditd.conf depending on your local security policies:
disk_full_action = <halt|single>
disk_error_action = <syslog|single|halt>
Example:
disk_full_action = halt
disk_error_action = halt
References
- NIST SP 800-53 Rev. 5: AU-2, AU-8, AU-12, SI-5
- AUDITD.CONF(5)
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.2 Collect Audit Logs | X | X | X |
| v8 | 8.3 Ensure Adequate Audit Log Storage | X | X | X |
MITRE ATT&CK Mappings: T1562, T1562.006 / TA0005 / M1028