From blank at eclipse.ncsc.mil Thu Aug 20 11:32:54 2015 Content-Type: multipart/mixed; boundary="===============8428331568244898902==" MIME-Version: 1.0 From: Jeffrey Blank To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 01/12] Changed content as per ticket #147. Date: Fri, 07 Dec 2012 10:01:03 -0500 Message-ID: <50C204AF.703@eclipse.ncsc.mil> In-Reply-To: 1354840070-40541-1-git-send-email-mnewman@redhat.com --===============8428331568244898902== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Please push this set -- thanks. Per our conversation with some of the FSO govt folks on Monday, some of the minor style changes can be at the vendor's (your) discretion; there is a requirement to conform to certain sentence structures and phrasing (and some of these may have been identified in the copy editing patches), but colons vs periods (or other extremely minor items, presumably contractions too) are at your discretion. It's desirable to present configuration actions to admins in the format they'd expect. Thanks! On 12/06/2012 07:27 PM, Michele Newman wrote: > --- > RHEL6/input/system/auditing.xml | 48 +++++++++++++++++++--------------= ----- > 1 files changed, 24 insertions(+), 24 deletions(-) > = > diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditin= g.xml > index 67cce9a..c14f3dc 100644 > --- a/RHEL6/input/system/auditing.xml > +++ b/RHEL6/input/system/auditing.xml > @@ -88,7 +88,7 @@ disk. > > > > -Ensuring that the auditd service is active ensures t= hat > +Ensuring the auditd service is active ensures = > audit records generated by the kernel can be written to disk, or that ap= propriate > actions will be taken if other obstacles exist. > > @@ -100,7 +100,7 @@ actions will be taken if other obstacles exist. > = > > Enable Auditing for Processes Which Start Prior to the Audit Daem= on > -To ensure that all processes can be audited, even > +To ensure all processes can be audited, even > those which start prior to the audit daemon, add the argument > audit=3D1 to the kernel line in /etc/grub.conf, in the= manner below: >
kernel /vmlinuz-version ro vga=3Dext root=3D/dev/VolGroup00/LogVol0=
0 rhgb quiet audit=3D1
> @@ -114,7 +114,7 @@ auditing is enabled at boot time. > Each process on the system carries an "auditable" flag which > indicates whether its activities can be audited. Although auditd > takes care of enabling this for all processes which launch after it > -does, adding the kernel argument ensures that it is set for every > +does, adding the kernel argument ensures it is set for every > process during boot. >
> > @@ -293,7 +293,7 @@ page. These include: > Set the ACTION to rotate to ensure log rotation > occurs. This is the default. The setting is case-insensitive. > > - > + > Inspect /etc/audit/auditd.conf and locate the following line to > determine if the system is configured to rotate logs when they reach the= ir > maximum size: = > @@ -344,7 +344,7 @@ These include: > Set this to email (instead of the default, > which is suspend) as it is more likely to get prompt attention. > > - + disk space is starting to run low"> > Inspect /etc/audit/auditd.conf and locate the following line to > determine if the system is configured to email the administrator when > @@ -383,7 +383,7 @@ mode for corrective action. For certain systems, the= need for availability > outweighs the need to log all actions, and a different setting should be > determined. > > - + mode for corrective action"> > Inspect /etc/audit/auditd.conf and locate the following line to > determine if the system is configured to switch to single user mode > @@ -408,7 +408,7 @@ in /etc/audit/auditd.conf to ensure that adm= inistrators are notified > via email for those situations: >
action_mail_acct =3D root
> > - > + > Inspect /etc/audit/auditd.conf and locate the following line to > determine if the system is configured to send email to an > account when it needs to notify an administrator: > @@ -465,7 +465,7 @@ editing as needed, the new rules can be activated as = follows: > > Records Events that Modify Date and Time Information > Arbitrary changes to the system time can be used to obfusca= te = > -nefarious activities in log files as well as to confuse network services= that = > +nefarious activities in log files, as well as to confuse network service= s that = > are highly dependent upon an accurate system time. All changes to the sy= stem = > time should be audited. > = > @@ -484,11 +484,11 @@ desired, but is not required. See an example of mul= tiple combined syscalls: >
-a always,exit -F arch=3Db64 -S adjtimex -S settimeofday -S clock_s=
ettime =

>  -k audit_time_rules
> > - > + > > > Arbitrary changes to the system time can be used to obfuscate = > -nefarious activities in log files as well as to confuse network services= that = > +nefarious activities in log files, as well as to confuse network service= s that = > are highly dependent upon an accurate system time (such as sshd). All ch= anges = > to the system time should be audited. > > @@ -512,11 +512,11 @@ desired, but is not required. See an example of mul= tiple combined syscalls: >
-a always,exit -F arch=3Db64 -S adjtimex -S settimeofday -S clock_s=
ettime =

>  -k audit_time_rules
> > - > + > > > Arbitrary changes to the system time can be used to obfuscate = > -nefarious activities in log files as well as to confuse network services= that = > +nefarious activities in log files, as well as to confuse network service= s that = > are highly dependent upon an accurate system time (such as sshd). All ch= anges = > to the system time should be audited. > > @@ -538,11 +538,11 @@ See an example of multiple combined syscalls: >
-a always,exit -F arch=3Db64 -S adjtimex -S settimeofday -S clock_s=
ettime =

>  -k audit_time_rules
> > - > + > > > Arbitrary changes to the system time can be used to obfuscate = > -nefarious activities in log files as well as to confuse network services= that = > +nefarious activities in log files, as well as to confuse network service= s that = > are highly dependent upon an accurate system time (such as sshd). All ch= anges = > to the system time should be audited. > > @@ -566,11 +566,11 @@ desired, but is not required. See an example of mul= tiple combined syscalls: >
-a always,exit -F arch=3Db64 -S adjtimex -S settimeofday -S clock_s=
ettime =

>  -k audit_time_rules
> > - > + > > > Arbitrary changes to the system time can be used to obfuscate = > -nefarious activities in log files as well as to confuse network services= that = > +nefarious activities in log files, as well as to confuse network service= s that = > are highly dependent upon an accurate system time (such as sshd). All ch= anges = > to the system time should be audited. > > @@ -587,7 +587,7 @@ The -k option allows for the specification of a key i= n string form that can > be used for better reporting capability through ausearch and aureport and > should always be used. > > - > + > To determine if the system is configured to audit attempts to > alter time via the /etc/localtime file, run the following > command: > @@ -595,7 +595,7 @@ command: > If the system is configured to audit this activity, it will return a lin= e. > > Arbitrary changes to the system time can be used to obfuscate = > -nefarious activities in log files as well as to confuse network services= that = > +nefarious activities in log files, as well as to confuse network service= s that = > are highly dependent upon an accurate system time (such as sshd). All ch= anges = > to the system time should be audited. > > @@ -616,7 +616,7 @@ to capture events that modify account changes: > -w /etc/shadow -p wa -k audit_account_changes > -w /etc/security/opasswd -p wa -k audit_account_changes > > - > + > To determine if the system is configured to audit account changes, > run the following command: >
auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshad=
ow|/etc/security/opasswd)'
> @@ -643,7 +643,7 @@ ARCH to either b32 or b64 as appropriate for your sys= tem: > -w /etc/hosts -p wa -k audit_network_modifications > -w /etc/sysconfig/network -p wa -k audit_network_modifications > > - > + > To determine if the system is configured to audit changes to its network= configuration, > run the following command: >
auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sys=
config/network)'
> @@ -697,7 +697,7 @@ owner, and unauthorized users, potential access to se= nsitive information. Add the following to /etc/audit/audit.rules: >
-w /etc/selinux/ -p wa -k MAC-policy
>
> - > + > To determine if the system is configured to audit changes to its SELinux > configuration files, run the following command: >
# auditctl -l | grep "dir=3D/etc/selinux"
> @@ -760,7 +760,7 @@ If the system is 64 bit then also add the following: > gain access to information that would otherwise be disallowed. Auditing = DAC modifications > can facilitate the identification of patterns of abuse among both author= ized and > unauthorized users. > - > + > > Note that these rules can be configured in= a = > @@ -1233,7 +1233,7 @@ appropriate for your system: > > > Auditing file deletions will create an audit trail for files = that are removed > -from the system. The audit trail could aid in system troubleshooting as = well as detecting > +from the system. The audit trail could aid in system troubleshooting, as= well as, detecting > malicious processes that attempt to delete log files to conceal their pr= esence. > > > @@ -1252,7 +1252,7 @@ To verify that auditing is configured for system ad= ministrator actions, run the >
# auditctl -l | grep "watch=3D/etc/sudoers"
>
> The actions taken by system administrators should be audited = to keep a record > -of what was executed on the system as well as for accountability purpose= s. > +of what was executed on the system, as well as, for accountability purpo= ses. > > > -- = ___________________________ Jeffrey Blank 410-854-8675 Technology and Systems Analysis / Network Components NSA Information Assurance --===============8428331568244898902==--