Pavois
FR
← All control domains

Audit (auditd): 22 controls for Linux hardening

Pavois audits 22 controls in the Audit (auditd) hardening domain, across 9 systems and 5 standards (CIS, ANSSI BP-028, NIST 800-53, PCI DSS, DISA STIG). Every control declares the evidence it gathers, its severity, its remediation and its standard references.

The domain in figures

Controls22
Severities
medium 22
Evidence gathered
effective runtime 22
Standards
CISANSSI BP-028NIST 800-53PCI DSSDISA STIG
Systems
Debian 12Debian 13FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8RHEL 9 / Rocky 9 / AlmaLinux 9Ubuntu 22.04Ubuntu 24.04Ubuntu 26.04
Coverage depthin depth

What does Pavois check in this domain?

effective runtime 22
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

Which standards does this domain cover?

One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.

CIS
6.2.3.1, 6.2.3.2, 6.2.3.4, 6.2.3.5, 6.2.3.7, 6.2.3.8, 6.2.3.9, 6.2.3.10, 6.2.3.11, 6.2.3.12, 6.2.3.13, 6.2.3.14, 6.2.3.17, 6.2.3.19, 6.2.3.20, 6.3.3.1, 6.3.3.2, 6.3.3.4, 6.3.3.5, 6.3.3.6, 6.3.3.7, 6.3.3.8, 6.3.3.9, 6.3.3.10, 6.3.3.11, 6.3.3.12, 6.3.3.13, 6.3.3.14, 6.3.3.15, 6.3.3.16, 6.3.3.17, 6.3.3.18, 6.3.3.19, 6.3.3.20, 6.3.3.21, 6.3.3.22, 6.3.3.23, 6.3.3.24, 6.3.3.25, 6.3.3.26, 6.3.3.27, 6.3.3.28, 6.3.3.29, 6.3.3.30, 6.3.3.31, 6.3.3.33, 6.6.3.18, 10.2.1.2, 10.2.1.3, 10.2.1.5, 10.2.1.7, 10.3.2, 10.3.4, 10.6.3
ANSSI BP-028
R33, R73
NIST 800-53
3.1.7, 3.1.8, 3.3.1, AC-2(4), AC-2(7)(b), AC-6(9), AU-2(d), AU-7(a), AU-7(b), AU-8(b), AU-12(3), AU-12(c), CM-5(1), CM-6(a)
PCI DSS
10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.7, 10.3.2, 10.3.4, 10.6.3
DISA STIG
UBTU-22-654010, UBTU-22-654015, UBTU-22-654020, UBTU-22-654025, UBTU-22-654030, UBTU-22-654035, UBTU-22-654040, UBTU-22-654041, UBTU-22-654045, UBTU-22-654050, UBTU-22-654055, UBTU-22-654060, UBTU-22-654065, UBTU-22-654070, UBTU-22-654075, UBTU-22-654080, UBTU-22-654085, UBTU-22-654090, UBTU-22-654095, UBTU-22-654100, UBTU-22-654105, UBTU-22-654110, UBTU-22-654115, UBTU-22-654120, UBTU-22-654125, UBTU-22-654130, UBTU-22-654135, UBTU-22-654140, UBTU-22-654145, UBTU-22-654150, UBTU-22-654155, UBTU-22-654160, UBTU-22-654165, UBTU-22-654170, UBTU-22-654175, UBTU-22-654180, UBTU-22-654185, UBTU-22-654190, UBTU-22-654195, UBTU-22-654200, UBTU-22-654205, UBTU-22-654210, UBTU-22-654215, UBTU-22-654230, UBTU-24-200270, UBTU-24-200280, UBTU-24-200290, UBTU-24-200300, UBTU-24-200310, UBTU-24-200320, UBTU-24-200580, UBTU-24-300029, UBTU-24-900070, UBTU-24-900080, UBTU-24-900090, UBTU-24-900100, UBTU-24-900110, UBTU-24-900120, UBTU-24-900130, UBTU-24-900140, UBTU-24-900150, UBTU-24-900160, UBTU-24-900170, UBTU-24-900180, UBTU-24-900190, UBTU-24-900200, UBTU-24-900210, UBTU-24-900220, UBTU-24-900230, UBTU-24-900240, UBTU-24-900250, UBTU-24-900260, UBTU-24-900270, UBTU-24-900280, UBTU-24-900290, UBTU-24-900300, UBTU-24-900310, UBTU-24-900320, UBTU-24-900330, UBTU-24-900340, UBTU-24-900350, UBTU-24-900510, UBTU-24-900520, UBTU-24-900540, UBTU-24-900590, UBTU-24-900600, UBTU-24-900610, UBTU-24-900730, UBTU-24-900740, UBTU-24-900750, UBTU-24-909000

The 22 controls of the Audit (auditd) domain

RefRuleSev.OSStandards
SOCLE-RUN-AUD-003Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/medium7
stig
SOCLE-RUN-AUD-005Ensure auditd Collects File Deletion Events by User - renamemedium9
bp28cisnistpci-dssstig
SOCLE-RUN-AUD-010Ensure auditd Collects Information on Exporting to Media (successful)medium9
bp28cisnistpci-dss
SOCLE-RUN-AUD-007Ensure auditd Collects Information on Kernel Module Unloading - create_modulemedium4
bp28cisnist
SOCLE-RUN-AUD-013Ensure auditd Collects Information on the Use of Privileged Commands - fdiskmedium3
bp28cisniststig
SOCLE-RUN-AUD-024Ensure auditd Collects records for events that affect "/var/log/journal"medium3
stig
SOCLE-RUN-AUD-019Ensure auditd Collects System Administrator Actionsmedium8
bp28cisnistpci-dssstig
SOCLE-RUN-AUD-006Make the auditd Configuration Immutablemedium9
bp28cisnistpci-dssstig
SOCLE-RUN-AUD-004Record Any Attempts to Run chaclmedium9
bp28cisniststig
SOCLE-RUN-AUD-008Record Attempts to Alter Logon and Logout Events - faillockmedium9
bp28cisnistpci-dssstig
SOCLE-RUN-AUD-015Record Attempts to Alter Process and Session Initiation Informationmedium9
bp28cisnistpci-dssstig
SOCLE-RUN-AUD-020Record attempts to alter time through adjtimexmedium9
bp28cisnistpci-dss
SOCLE-RUN-AUD-021Record Attempts to Alter Time Through clock_settimemedium9
bp28cisnistpci-dss
SOCLE-RUN-AUD-001Record Events that Modify the System's Discretionary Access Controls - chmodmedium9
bp28cisnistpci-dssstig
SOCLE-RUN-AUD-009Record Events that Modify the System's Mandatory Access Controlsmedium9
bp28cisnistpci-dss
SOCLE-RUN-AUD-011Record Events that Modify the System's Network Environmentmedium9
cisnistpci-dssbp28
SOCLE-RUN-AUD-012Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scriptsmedium4
cis
SOCLE-RUN-AUD-023Record Events that Modify User/Group Information - /etc/groupmedium9
bp28cisnistpci-dssstig
SOCLE-RUN-AUD-002Record Events that Modify User/Group Information via open syscall - /etc/groupmedium1
SOCLE-RUN-AUD-017Record Events When Executables Are Run As Another Usermedium9
cis
SOCLE-RUN-AUD-018Record Events When Privileged Executables Are Runmedium7
nistpci-dssstigcis
SOCLE-RUN-AUD-022Record Unsuccessful Access Attempts to Files - creatmedium9
bp28cisnistpci-dssstig

Sources & references

Pavois handbook: Audit logging with auditdauditd hardening, blog.stephane-robert.info ↗
auditctl ↗auditd ↗

Full control catalogue · All control domains