documentation_complete: true


title: 'Record Attempts to perform maintenance activities'

description: |-
    The {{{ full_name }}} operating system must generate audit records for
    privileged activities, nonlocal maintenance, diagnostic sessions and
    other system-level access.

    Verify the operating system audits activities performed during nonlocal
    maintenance and diagnostic sessions. Run the following command:
    <pre>$ sudo auditctl -l | grep sudo.log
    -w /var/log/sudo.log -p wa -k maintenance</pre>

    {{{ describe_audit_rules_watch("/var/log/sudo.log", "maintenance") }}}

rationale: |-
    If events associated with nonlocal administrative access or diagnostic
    sessions are not logged, a major tool for assessing and investigating
    attacks would not be available.
    This requirement addresses auditing-related issues associated with
    maintenance tools used specifically for diagnostic and repair actions
    on organizational information systems.
    Nonlocal maintenance and diagnostic activities are those activities
    conducted by individuals communicating through a network, either an
    external network (e.g., the internet) or an internal network. Local
    maintenance and diagnostic activities are those activities carried
    out by individuals physically present at the information system or
    information system component and not communicating across a network
    connection.
    This requirement applies to hardware/software diagnostic test
    equipment or tools. This requirement does not cover hardware/software
    components that may support information system maintenance, yet are a
    part of the system, for example, the software implementing "ping,"
    "ls," "ipconfig," or the hardware and software implementing the
    monitoring port of an Ethernet switch.

severity: medium

identifiers:
    cce@rhel8: CCE-86432-2
    cce@rhel9: CCE-86433-0
    cce@rhel10: CCE-89542-5
    cce@sle12: CCE-92355-7
    cce@sle15: CCE-92551-1
    cce@slmicro5: CCE-93863-9

references:
    cis@sle12: 4.1.15
    cis@sle15: 4.1.15
    pcidss: Req-10.2.2,Req-10.2.5.b
    srg: SRG-OS-000392-GPOS-00172,SRG-OS-000471-GPOS-00215

ocil_clause: 'Audit rule is not present'

ocil: |-
    {{{ ocil_audit_rules_watch("/var/log/sudo.log", "maintenance") }}}

template:
    name: audit_rules_watch
    vars:
        path: /var/log/sudo.log
        key: maintenance
