{"description": "The auditd service can be configured to send email to\na designated account in certain situations. Add or correct the following line\nin /etc/audit/auditd.conf to ensure that administrators are notified\nvia email for those situations:\n
action_mail_acct =
", "rationale": "Email sent to the root account is typically aliased to the\nadministrators of the system, who can take appropriate action.", "severity": "medium", "references": {"cis-csc": ["1", "11", "12", "13", "14", "15", "16", "19", "2", "3", "4", "5", "6", "7", "8"], "cjis": ["5.4.1.1"], "cobit5": ["APO11.04", "APO12.06", "APO13.01", "BAI03.05", "BAI04.04", "BAI08.02", "DSS02.02", "DSS02.04", "DSS02.07", "DSS03.01", "DSS05.04", "DSS05.07", "MEA02.01"], "cui": ["3.3.1"], "hipaa": ["164.312(a)(2)(ii)"], "isa-62443-2009": ["4.2.3.10", "4.3.3.3.9", "4.3.3.5.8", "4.3.4.4.7", "4.3.4.5.6", "4.3.4.5.7", "4.3.4.5.8", "4.4.2.1", "4.4.2.2", "4.4.2.4"], "isa-62443-2013": ["SR 2.10", "SR 2.11", "SR 2.12", "SR 2.8", "SR 2.9", "SR 6.1", "SR 7.1", "SR 7.2"], "iso27001-2013": ["A.12.1.3", "A.12.4.1", "A.12.4.2", "A.12.4.3", "A.12.4.4", "A.12.7.1", "A.16.1.4", "A.16.1.5", "A.16.1.7", "A.17.2.1"], "nerc-cip": ["CIP-003-8 R1.3", "CIP-003-8 R3", "CIP-003-8 R3.1", "CIP-003-8 R3.2", "CIP-003-8 R3.3", "CIP-003-8 R5.1.1", "CIP-003-8 R5.3", "CIP-004-6 R2.2.3", "CIP-004-6 R2.3", "CIP-007-3 R5.1", "CIP-007-3 R5.1.2", "CIP-007-3 R5.2", "CIP-007-3 R5.3.1", "CIP-007-3 R5.3.2", "CIP-007-3 R5.3.3"], "nist": ["IA-5(1)", "AU-5(a)", "AU-5(2)", "CM-6(a)"], "nist-csf": ["DE.AE-3", "DE.AE-5", "PR.DS-4", "PR.PT-1", "RS.AN-1", "RS.AN-4"], "pcidss": ["Req-10.7.a"], "srg": ["SRG-OS-000046-GPOS-00022", "SRG-OS-000343-GPOS-00134"], "cis": ["6.3.2.4"], "stigid": ["UBTU-22-653025"], "stigref": ["SV-260593r958424_rule"]}, "control_references": {"cis": ["6.3.2.4"], "stigid": ["UBTU-22-653025"]}, "components": [], "identifiers": {}, "ocil_clause": "the value of the \"action_mail_acct\" keyword is not set to \"\" and/or other accounts for security personnel, the \"action_mail_acct\" keyword is missing, or the returned line is commented out, ask the system administrator to indicate how they and the ISSO are notified of an audit process failure. If there is no evidence of the proper personnel being notified of an audit processing failure", "ocil": "Verify that Ubuntu 22.04 is configured to notify the SA and/or ISSO (at a minimum) in the event of an audit processing failure with the following command:\n\n
$ sudo grep action_mail_acct /etc/audit/auditd.conf\n\naction_mail_acct =
", "oval_external_content": null, "fixtext": "Configure \"auditd\" service to notify the SA and ISSO in the event of an audit processing failure.\n\nEdit the following line in \"/etc/audit/auditd.conf\" to ensure that administrators are notified via email for those situations:\n\naction_mail_acct = \n\nThe audit daemon must be restarted for changes to take effect.", "checktext": "", "vuldiscussion": "", "srg_requirement": "The Ubuntu 22.04 System Administrator (SA) and/or Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.\nUbuntu 22.04 must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached.", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "The Ubuntu 22.04 System Administrator (SA) and/or Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.", "vuldiscussion": "It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.\n\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\n\nThis requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.", "checktext": "Verify that Ubuntu 22.04 is configured to notify the SA and/or ISSO (at a minimum) in the event of an audit processing failure with the following command:\n\n$ sudo grep action_mail_acct /etc/audit/auditd.conf\n\naction_mail_acct = root\n\nIf the value of the \"action_mail_acct\" keyword is not set to \"root\" and/or other accounts for security personnel, the \"action_mail_acct\" keyword is missing, or the returned line is commented out, ask the system administrator to indicate how they and the ISSO are notified of an audit process failure. If there is no evidence of the proper personnel being notified of an audit processing failure, this is a finding.", "fixtext": "Configure \"auditd\" service to notify the SA and ISSO in the event of an audit processing failure.\n\nEdit the following line in \"/etc/audit/auditd.conf\" to ensure that administrators are notified via email for those situations:\n\naction_mail_acct = root\n\nThe audit daemon must be restarted for changes to take effect."}}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": ["package[audit]", "system_with_kernel"], "cpe_platform_names": [], "inherited_cpe_platform_names": ["system_with_kernel", "package_audit"], "bash_conditional": null, "fixes": {}, "title": "Configure auditd mail_acct Action on Low Disk Space", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/auditing/configure_auditd_data_retention/auditd_data_retention_action_mail_acct/rule.yml", "template": null}