documentation_complete: true

prodtype: rhel7

title: 'Record Attempts to Alter Logon and Logout Events - lastlog'

description: |-
    The audit system already collects login information for all users
    and root. If the <tt>auditd</tt> daemon is configured to use the
    <tt>augenrules</tt> program to read audit rules during daemon startup (the
    default), add the following lines to a file with suffix <tt>.rules</tt> in the
    directory <tt>/etc/audit/rules.d</tt> in order to watch for attempted manual
    edits of files involved in storing logon events:
    <pre>-w /var/log/lastlog -p wa -k logins</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following lines to
    <tt>/etc/audit/audit.rules</tt> file in order to watch for unattempted manual
    edits of files involved in storing logon events:
    <pre>-w /var/log/lastlog -p wa -k logins</pre>

rationale: |-
    Manual editing of these files may indicate nefarious activity, such
    as an attacker attempting to remove evidence of an intrusion.

severity: medium

identifiers:
    cce@rhel7: 80384-1

references:
    cis: 5.2.8
    cui: 3.1.7
    disa: 172,2884,126
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
    nist: AC-17(7),AU-1(b),AU-12(a),AU-12(c),IR-5
    ospp@rhel7: FAU_GEN.1.1.c
    pcidss: Req-10.2.3
    srg: SRG-OS-000392-GPOS-00172,SRG-OS-000470-GPOS-00214,SRG-OS-000473-GPOS-00218
    stigid@rhel7: "030620"

ocil_clause: 'there is not output'

ocil: |-
    To verify that auditing is configured for system administrator actions, run the following command:
    <pre>$ sudo auditctl -l | grep "watch=/var/log/lastlog"</pre>
