lowauditverified ✓rollback-safe
Configure auditd action_mail_acct
auditd-action-mail-acct · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The auditd action_mail_acct parameter should be set to root so that critical audit alerts are sent to the root administrator.
Rationale
Audit events that require action (disk full, errors) should be communicated to administrators. Setting action_mail_acct ensures the root user receives these critical notifications.
Check → Remediate
Checkconfig_value
- path:
- /etc/audit/auditd.conf
- key:
- action_mail_acct
- expected:
- root
Remediateconfig_set
- path:
- /etc/audit/auditd.conf
- key:
- action_mail_acct
- value:
- root
- separator:
- =
- restart:
- auditd
Framework references
STIG
V-230388 / RHEL-08-030020V-258163 / RHEL-09-653070V-270819 / UBTU-24-900980V-260593 / UBTU-22-653025V-281114 / RHEL-10-500210
NIST 800-53
AU-4AU-5AU-5(2)
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:checkubuntu26:check
#audit#notification#mail#configuration