cis-ubuntu2004-v300-6-3-2-3

name	cis-ubuntu2004-v300-6-3-2-3
description	Ensure system is disabled when audit logs are full
category	cis-logging
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","auditing","auditd"]
cis_id	6.3.2.3
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.3.2.3 Ensure system is disabled when audit logs are full (Automated)

Profile

• Level 2 - Server
• Level 2 - Workstation

Description

The auditd daemon can be configured to halt the system or put the system in single user mode, if no free space is available or an error is detected on the partition that holds the audit log files.

The disk_full_action parameter tells the system what action to take when no free space is available on the partition that holds the audit log files. Valid values are ignore, syslog, rotate, exec, suspend, single, and halt.

The disk_error_action parameter tells the system what action to take when an error is detected on the partition that holds the audit log files. Valid values are ignore, syslog, exec, suspend, single, and halt.

Rationale

In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.

Impact

disk_full_action parameter:

• Set to halt - the auditd daemon will shutdown the system when the disk partition containing the audit logs becomes full.
• Set to single - the auditd daemon will put the computer system in single user mode when the disk partition containing the audit logs becomes full.

disk_error_action parameter:

• Set to halt - the auditd daemon will shutdown the system when an error is detected on the partition that holds the audit log files.
• Set to single - the auditd daemon will put the computer system in single user mode when an error is detected on the partition that holds the audit log files.
• Set to syslog - the auditd daemon will issue no more than 5 consecutive warnings to syslog when an error is detected on the partition that holds the audit log files.

Audit Procedure

Command Line

Run the following command and verify the is set to either or :