mediumauditverified ✓rollback-safe
Audit uses of the shutdown command
audit-cmd-shutdown · RHEL ≥ 9 · 1 impl
Description
All uses of the shutdown command must be audited. The shutdown command halts, powers off, or reboots the system.
Rationale
Auditing shutdown command usage allows detection of unauthorized system state changes that could cause service disruption.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged
Remediateaudit_rule_set
- rule:
- -a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged
- persist_file:
- /etc/audit/rules.d/50-privileged.rules
Framework references
STIG
V-281151 / RHEL-10-500650V-258214 / RHEL-09-654200
NIST 800-53
AU-2AU-12
Live verification
rhel9:check
#audit#auditd#privileged#system