mediumauditunverified
Audit sethostname/setdomainname (RHEL 10 syscall form)
audit-hostname-change-rhel10 · RHEL ≥ 10 · 1 impl
Description
On RHEL 10 the system-locale audit controls use syscall rules. Record use of the sethostname and setdomainname syscalls (both ABIs).
Rationale
Changes to the host/domain name affect system identity and network trust; auditing the syscalls provides attribution.
Check → Remediate
Checkcomposed · 2 sub-checks (all must pass)
- 1. audit_rule_exists:
- rule=-a always,exit -F arch=b64 -S sethostname,setdomainname -F key=system-locale
- 2. audit_rule_exists:
- rule=-a always,exit -F arch=b32 -S sethostname,setdomainname -F key=system-locale
Remediatemanual
- note:
- Add the two sethostname/setdomainname audit rules (b64+b32, -k system-locale) to /etc/audit/rules.d/ and augenrules --load.
Framework references
CIS
rhel10 6.3.3.5
NIST 800-53
AU-12
#audit#system-locale#hostname#cis