cis-ubuntu1604-v200-4-1-7

name	cis-ubuntu1604-v200-4-1-7
description	Ensure login and logout events are collected
category	cis-logging
version	2.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-16.04","auditd","logging"]
cis_id	4.1.7
cis_benchmark	CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Control 4.1.7

Profile

• Level: 2 - Server
• Level: 2 - Workstation
• Assessment Status: Automated

Description

Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logged in. The file /var/log/tallylog maintains records of failures via the pam_tally2 module.

Note: Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.

Rationale

Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.

Impact

None.

Audit Procedure

Command Line

Run the following command to verify the rules are contained in a .rules file in the /etc/audit/rules.d/ directory:

grep logins /etc/audit/rules.d/*.rules

Verify output includes:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Run the following command to verify that rules are in the running auditd config:

auditctl -l | grep logins

Verify output includes:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Expected Result

Output should include the rules listed above.

Remediation

Command Line

Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules.

Example: vi /etc/audit/rules.d/50-logins.rules

Add the following lines:

-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins

Default Value

By default, no audit rules are configured for login/logout events.

References

1. CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Section 4.1.7

CIS Controls