lowauditverified ✓

Ensure the audit event multiplexor offloads records to a remote system

audit-offload-audispd-remote · UBUNTU ≥ 22 · 1 impl

Description

The audispd-plugins package must be installed and the au-remote plugin must be active so that audit records are offloaded to a different system or storage medium from the one being audited.

Rationale

Offloading audit records to a separate system protects the audit trail from tampering or loss if the audited host is compromised, and helps ensure audit storage capacity is not exhausted locally.

Check → Remediate

Checkcommand

dpkg -l 2>/dev/null | grep -qE '^ii[[:space:]]+audispd-plugins([[:space:]]|:)' || {
  echo "FAIL: audispd-plugins package is not installed"; exit 1; }
conf=/etc/audit/plugins.d/au-remote.conf
[ -f "$conf" ] || conf=/etc/audisp/plugins.d/au-remote.conf
grep -iqE '^[[:space:]]*active[[:space:]]*=[[:space:]]*yes' "$conf" 2>/dev/null || {
  echo "FAIL: au-remote plugin is not active"; exit 1; }
echo "OK: audispd-plugins installed and au-remote active"; exit 0

expected_exit:: 0

Remediatemanual

note:: Install audispd-plugins, set 'active = yes' in the au-remote plugin config, and set 'remote_server' in audisp-remote.conf to the log host, then restart auditd.

Framework references

STIG

V-270658 / UBTU-24-100450V-260592 / UBTU-22-653020

NIST 800-53

AU-4(1)

Live verification

ubuntu22:checkubuntu24:check

#audit#audispd#remote-offload#stig