mediumauditunverified
Audit write/attribute changes to /etc/gshadow (RHEL 10)
audit-gshadow-write-rhel10 · RHEL ≥ 10 · 1 impl
Description
On RHEL 10, record write and attribute changes to /etc/gshadow via the syscall-form audit rule (RHEL 10 deprecated the legacy -w watch form).
Rationale
Auditing changes to group password files supports detection of unauthorized modification and forensic reconstruction.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F path=/etc/gshadow -F perm=wa
Remediatemanual
- note:
- Add `-a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -k identity` (and the b32 form) to /etc/audit/rules.d/ and augenrules --load.
Framework references
STIG
V-281157 / RHEL-10-500710
NIST 800-53
AU-12AC-6
#audit#gshadow#stig