documentation_complete: true

prodtype: rhel7,fedora

title: 'Ensure <tt>auditd</tt> Collects System Administrator Actions'

description: |-
    At a minimum, the audit system should collect administrator actions
    for all users and root. If the <tt>auditd</tt> daemon is configured to use the
    <tt>augenrules</tt> program to read audit rules during daemon startup (the default),
    add the following line to a file with suffix <tt>.rules</tt> in the directory
    <tt>/etc/audit/rules.d</tt>:
    <pre>-w /etc/sudoers -p wa -k actions
    -w /etc/sudoers.d/ -p wa -k actions</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following line to
    <tt>/etc/audit/audit.rules</tt> file:
    <pre>-w /etc/sudoers -p wa -k actions
    -w /etc/sudoers.d/ -p wa -k actions</pre>

rationale: |-
    The actions taken by system administrators should be audited to keep a record
    of what was executed on the system, as well as, for accountability purposes.

severity: unknown

identifiers:
    cce@rhel7: 27461-3

references:
    cjis: 5.4.1.1
    cui: 3.1.7
    disa: 126,130,135,172,2884
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
    nist: AC-2(7)(b),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),iAU-3(1),AU-12(a),AU-12(c),IR-5
    ospp@rhel7: FAU_GEN.1.1.c
    pcidss: Req-10.2.2,Req-10.2.5.b
    srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215
    stigid@rhel7: "030700"

ocil_clause: 'there is not output'

ocil: |-
    To verify that auditing is configured for system administrator actions, run the following command:
    <pre>$ sudo auditctl -l | grep "watch=/etc/sudoers\|watch=/etc/sudoers.d"</pre>
