mediumauditunverified
Audit write/attribute changes to /etc/sudoers (RHEL 10)
audit-sudoers-write-rhel10 · RHEL ≥ 10 · 1 impl
Description
On RHEL 10, record write and attribute changes to /etc/sudoers via the syscall-form audit rule (RHEL 10 deprecated the legacy -w watch form).
Rationale
Auditing changes to sudo privilege files supports detection of unauthorized modification and forensic reconstruction.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F path=/etc/sudoers -F perm=wa
Remediatemanual
- note:
- Add `-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -k logins` (and the b32 form) to /etc/audit/rules.d/ and augenrules --load.
Framework references
STIG
V-281154 / RHEL-10-500680
NIST 800-53
AU-12AC-6
#audit#sudoers#stig