AC-02(01) Automated System Account Management
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Automated System Account Management
Control
Support the management of system accounts using [Assignment: automated mechanisms].
Discussion
Automated system account management includes using automated mechanisms to create, enable, modify, disable, and remove accounts; notify account managers when an account is created, enabled, modified, disabled, or removed, or when users are terminated or transferred; monitor system account usage; and report atypical system account usage. Automated mechanisms can include internal system functions and email, telephonic, and text messaging notifications.
Parameters
ac-02.01_odp: automated mechanisms
Assessment objective
AC-02(01) the management of system accounts is supported using [Assignment: automated mechanisms].
STIG rules that implement this control 21
Application Security and Development V6R5
- APSC-DV-000280 CAT II The application must provide automated mechanisms for supporting account management functions.
- APSC-DV-000380 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are created.
- APSC-DV-000390 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified.
- APSC-DV-000400 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) of account disabling actions.
- APSC-DV-000410 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) of account removal actions.
- APSC-DV-000430 CAT III The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-500680 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
- RHEL-10-500690 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers.d/" directory.
- RHEL-10-500700 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".
- RHEL-10-500710 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
- RHEL-10-500720 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd".
- RHEL-10-500730 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".
- RHEL-10-500740 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow".
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-215101 CAT II RHEL 9 must have the Postfix package installed.
- RHEL-09-654215 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
- RHEL-09-654220 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/directory.
- RHEL-09-654225 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
- RHEL-09-654230 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
- RHEL-09-654235 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
- RHEL-09-654240 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
- RHEL-09-654245 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.