Audit Successful and Unsuccessful Logon Attempts
An attacker might attempt to log in as an authorized user, through stolen credentials, unpatched exploits, or brute force attempts to guess a valid username and password. If a user is attempting to log in to a system at an unusual time, or if there are many failed attempts, there is a possibility that the system is the target of an attack. Auditing logon events mitigates this risk by recording all logon attempts, successful and unsuccessful, to the system.
[exists/does_not_exist]
In order to view the currently configured flags for the audit daemon, run the following command:
sudo grep ^flags /etc/security/audit_control
Logon events are logged by way of the 'aa' flag. If 'aa' is not listed in the result of the check, this is a finding.
oval:org.secpod.oval:def:25063
SCAP Repo OVAL Definition
2015-06-12