The macOS system must be configured to audit all log on and log out events.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-259453	SRG-OS-000032-GPOS-00013	APPL-14-001002	SV-259453r958406_rule	2024-12-04	2

Description
The audit system must be configured to record all attempts to log in and out of the system (lo). Frequently, an attacker that successfully gains access to a system has only gained access to an account with limited privileges, such as a guest account or a service account. The attacker must attempt to change to another user account with normal or elevated privileges in order to proceed. Auditing both successful and unsuccessful attempts to switch to another user account (by way of monitoring log on and log out events) mitigates this risk. The information system monitors log on and log out events. Satisfies: SRG-OS-000032-GPOS-00013,SRG-OS-000064-GPOS-00033,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000471-GPOS-00216,SRG-OS-000472-GPOS-00217,SRG-OS-000473-GPOS-00218

Description

The audit system must be configured to record all attempts to log in and out of the system (lo). Frequently, an attacker that successfully gains access to a system has only gained access to an account with limited privileges, such as a guest account or a service account. The attacker must attempt to change to another user account with normal or elevated privileges in order to proceed. Auditing both successful and unsuccessful attempts to switch to another user account (by way of monitoring log on and log out events) mitigates this risk. The information system monitors log on and log out events. Satisfies: SRG-OS-000032-GPOS-00013,SRG-OS-000064-GPOS-00033,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000471-GPOS-00216,SRG-OS-000472-GPOS-00217,SRG-OS-000473-GPOS-00218

ℹ️ Check
Verify the macOS system is configured to audit all log on and log out events with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec '^lo' If the result is not "1", this is a finding.

✔️ Fix
Configure the macOS system to audit all log on and log out events with the following command: /usr/bin/grep -qE "^flags.*[^-]lo" /etc/security/audit_control \|\| /usr/bin/sed -i.bak '/^flags/ s/$/,lo/' /etc/security/audit_control; /usr/sbin/audit -s A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.