>From 666565b32f05bf1424e22216149d3fa5d5f85b12 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 28 Sep 2013 20:13:02 -0400 Subject: [PATCH 8/8] OVAL signoff auditd_data_retention_action_mail_acct [root@SSG-RHEL6 checks]# ./testcheck.py auditd_data_retention_action_mail_acct.xml external_variable with id : var_auditd_action_mail_acct Evaluating with OVAL tempfile : /tmp/auditd_data_retention_action_mail_acct4HHdiP.xml Writing results to : /tmp/auditd_data_retention_action_mail_acct4HHdiP.xml-results Definition oval:scap-security-guide.testing:def:335: true Evaluation done. [root@SSG-RHEL6 checks]# grep action_mail_acct /etc/audit/auditd.conf action_mail_acct = root [root@SSG-RHEL6 checks]# sed -i 's/action_mail_acct = root/action_mail_acct = fail/g' /etc/audit/auditd.conf [root@SSG-RHEL6 checks]# grep action_mail_acct /etc/audit/auditd.conf action_mail_acct = fail [root@SSG-RHEL6 checks]# ./testcheck.py auditd_data_retention_action_mail_acct.xml external_variable with id : var_auditd_action_mail_acct Evaluating with OVAL tempfile : /tmp/auditd_data_retention_action_mail_acctTYheVO.xml Writing results to : /tmp/auditd_data_retention_action_mail_acctTYheVO.xml-results Definition oval:scap-security-guide.testing:def:335: false Evaluation done. --- RHEL6/input/auxiliary/stig_overlay.xml | 2 +- .../auditd_data_retention_action_mail_acct.xml | 3 --- RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +- RHEL6/input/profiles/stig-rhel6-server.xml | 2 +- RHEL6/input/profiles/test.xml | 2 +- RHEL6/input/system/auditing.xml | 2 +- 7 files changed, 6 insertions(+), 9 deletions(-) diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 072376b..b65c320 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -696,7 +696,7 @@ The audit system must provide a warning when allocated audit record storage volume reaches a documented percentage of maximum audit record storage capacity. - + The audit system must identify staff members to receive notifications of audit log storage volume capacity issues. diff --git a/RHEL6/input/checks/auditd_data_retention_action_mail_acct.xml b/RHEL6/input/checks/auditd_data_retention_action_mail_acct.xml index 609460f..99ce48f 100644 --- a/RHEL6/input/checks/auditd_data_retention_action_mail_acct.xml +++ b/RHEL6/input/checks/auditd_data_retention_action_mail_acct.xml @@ -7,11 +7,9 @@ action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account - - @@ -31,5 +29,4 @@ - diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml index 6e6d7bd..9b6da2d 100644 --- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml +++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml @@ -196,7 +196,7 @@ - -