mediumauditverified ✓rollback-safe
Ensure login and logout events are collected
audit-logins · RHEL ≥ 8 · 1 impl
Description
Login and logout events must be collected.
Rationale
Without auditing these events, malicious activity could go undetected, compromising forensic capabilities.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -k logins
Remediateaudit_rule_set
- rule:
- -w /var/log/lastlog -p wa -k logins
- persist_file:
- /etc/audit/rules.d/50-logins.rules
Framework references
CIS
rhel8 6.3.3.12rhel9 6.3.3.12rhel10 6.3.3.23
NIST 800-53
AU-2AU-12AC-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#audit#auditd