>From 1b2c3c283097a3c5bf52475ab02227f3fc395065 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 21 Feb 2012 21:50:07 -0500 Subject: [PATCH 02/11] - Updated audit_time_rules to reflect different audit rules for 32 & 64bit systems. - Changed key to audit_time_rules to match rule ID --- rhel6/src/input/system/auditing.xml | 19 ++++++++++++------- 1 files changed, 12 insertions(+), 7 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 898645b..63dcad4 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -147,17 +147,22 @@ editing as needed, activate the new rules: Records Events that Modify Date and Time Information -Add the following to /etc/audit/audit.rules, setting -ARCH to either b32 or b64 as appropriate for your system: +On a 32-bit system, add the following to /etc/audit/audit.rules:
-
--a always,exit -F arch=ARCH -S adjtimex -S settimeofday -S stime -k time-change
--a always,exit -F arch=ARCH -S clock_settime -k time-change
--w /etc/localtime -p wa -k time-change
+
# audit_time_rules
+-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -k audit_time_rules
+-w /etc/localtime -p wa -k audit_time_rules
+
+On a 64-bit system, add the following to /etc/audit/audit.rules (note the lack of -S stime, which is not relevant for a 64-bit installation): +
+
# audit_time_rules
+-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules
+-w /etc/localtime -p wa -k audit_time_rules
+
Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent -upon an accurate system time. All changes to the system time should be audited. +upon an accurate system time (such as sshd). All changes to the system time should be audited. -- 1.7.1