>From fb9ffa51dde0a6370a1e8275aba74adbe601b695 Mon Sep 17 00:00:00 2001 From: Michael McConachie Date: Wed, 26 Sep 2012 13:51:14 -0400 Subject: [PATCH 1/4] OCIL clause changes for input/system/auditing.xml --- RHEL6/input/system/auditing.xml | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index a8ebc90..2c5f23c 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -104,7 +104,7 @@ those which start prior to the audit daemon, add the argument audit=1 to the kernel line in /etc/grub.conf, in the manner below:
kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1
- + Inspect the kernel boot arguments (which follow the word kernel) in /etc/grub.conf to ensure that they include audit=1. @@ -235,7 +235,7 @@ line, substituting NUMLOGS with the correct value:
num_logs = NUMLOGS
Set the value to 5 for general-purpose systems. Note that values less than 2 result in no log rotation. - + Inspect /etc/audit/auditd.conf and locate the following line to determine how many logs the system is configured to retain after rotation:
num_logs = 5
@@ -257,7 +257,7 @@ the correct value for STOREMB: Set the value to 6 (MB) or higher for general-purpose systems. Larger values, of course, support retention of even more audit data. - + Inspect /etc/audit/auditd.conf and locate the following line to determine how much data the system will retain in each audit log file:
max_log_file = 6
@@ -287,7 +287,7 @@ page. These include: Set the ACTION to rotate to ensure log rotation occurs. This is the default. The setting is case-insensitive. - + Inspect /etc/audit/auditd.conf and locate the following line to determine if the system is configured to rotate logs when they reach their maximum size:
max_log_file_action rotate
@@ -335,7 +335,8 @@ These include: Set this to email (instead of the default, which is suspend) as it is more likely to get prompt attention. - + Inspect /etc/audit/auditd.conf and locate the following line to determine if the system is configured to email the administrator when disk space is starting to run low: @@ -371,7 +372,8 @@ mode for corrective action. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. - + Inspect /etc/audit/auditd.conf and locate the following line to determine if the system is configured to switch to single user mode when disk space has run low: @@ -394,7 +396,7 @@ in /etc/audit/auditd.conf to ensure that administrators are notified via email for those situations:
action_mail_acct = root
- + Inspect /etc/audit/auditd.conf and locate the following line to determine if the system is configured to send email to an account when it needs to notify an administrator: @@ -470,7 +472,7 @@ desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules
- + Arbitrary changes to the system time can be used to obfuscate @@ -498,7 +500,7 @@ desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules
- + Arbitrary changes to the system time can be used to obfuscate @@ -524,7 +526,7 @@ See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules
- + Arbitrary changes to the system time can be used to obfuscate @@ -552,7 +554,7 @@ desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
 -k audit_time_rules
- + Arbitrary changes to the system time can be used to obfuscate @@ -573,7 +575,7 @@ The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used. - + To determine if the system is configured to audit attempts to alter time via the /etc/localtime file, run the following command: @@ -602,7 +604,7 @@ to capture events that modify account changes: -w /etc/shadow -p wa -k audit_account_changes -w /etc/security/opasswd -p wa -k audit_account_changes - + To determine if the system is configured to audit account changes, run the following command:
auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'
@@ -629,7 +631,7 @@ ARCH to either b32 or b64 as appropriate for your system: -w /etc/hosts -p wa -k audit_network_modifications -w /etc/sysconfig/network -p wa -k audit_network_modifications - + To determine if the system is configured to audit changes to its network configuration, run the following command:
auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'
@@ -651,7 +653,7 @@ Controls Add the following to /etc/audit/audit.rules:
-w /etc/selinux/ -p wa -k MAC-policy
- + To determine if the system is configured to audit changes to its SELinux configuration files, run the following command:
# auditctl -l | grep "dir=selinux"
@@ -716,7 +718,7 @@ If the system is 64 bit then also add the following: gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users.
- + Note that these rules can be configured in a -- 1.7.11.4