From sgrubb at redhat.com Thu Aug 20 11:31:06 2015 Content-Type: multipart/mixed; boundary="===============0801171063980857810==" MIME-Version: 1.0 From: Steve Grubb To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH v2] Fixed titles for CCEs 14904-7 and 14697-5 Date: Thu, 10 May 2012 11:56:27 -0400 Message-ID: <201205101156.27829.sgrubb@redhat.com> In-Reply-To: 4FABE3DD.8080205@eclipse.ncsc.mil --===============0801171063980857810== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Thursday, May 10, 2012 11:50:53 AM Jeffrey Blank wrote: > Not necessarily. There are plenty of files that could qualify > (including /var/log/tallylog) for being added to this Rule. This is > really about deciding where to stop / priorities. Right. In the stig.rules file its commented out. If you are super paranoid = you = could use it. This reminds me that it needs updating for pam_faillock... > This particular Rule does not exist to satisfy a requirement: it is > really quite optional in itself and fits in the "best practices realm". > It exists to provide additional information about what may be going on. > (The actual requirements in OS SRG include auditing login/logout, and > auditing unsuccessful accesses to files, and we have Rules for those.) > The stig.rules file in > /usr/share/doc/audit-VERSION provides explanation. > = > On 05/08/2012 06:01 PM, Shawn Wells wrote: > > On 5/4/12 5:43 PM, Michael Palmiotto wrote: > >> + > >> + Record Attempts to Alter Logon and Logout Events > >> + > >> +The audit system already collects login info for all users and root. > >> To watch for attempted manual edits of > >> +files involved in storing logon events, add the following > >> to/etc/audit/audit.rules: > >> +
> >> +-w /var/log/faillog -p wa -k logins
> >> +-w /var/log/lastlog -p wa -k logins
> >> +
> >> +
> >> + > >> + > >> + > >> +
> > = > > Based on the shouldn't /var/log/secure be added to the > > watch list too? Nothing in syslog is authoritative. It can be spoofed by any application or = user. The audit logs are the only reliable source of security events. -Steve --===============0801171063980857810==--