>From 9fb277fb54e5b2bc7ed9d487ac1094709722900e Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 10 Jan 2013 07:34:59 -0500 Subject: [PATCH 03/20] Added AU-2* mappings Added several AU-2* mappings AU-2(a) - Defines what events must be audited AU-2(b) - Procedural / organizational orchistration with involved parties. NA for an OS. AU-2(c) - Calls for providing rationale on why AU-2(a) events must be audited. IMHO tag takes care of this. AU-2(d) - Refines what events from AU-2(a) must be audited based on a higher frequency. Since Linux Auditing is "realtime," all rules mapped to AU-2(a) can be mapped to AU-2(d) AU-2(3) - Procedural, review AU-2(a) selected events periodically AU-2(4) - Req to audit privileged commands --- RHEL6/input/auxiliary/nist_support.xml | 2 +- RHEL6/input/profiles/nist-CL-IL-AL.xml | 3 -- RHEL6/input/system/auditing.xml | 60 ++++++++++++++++---------------- 3 files changed, 31 insertions(+), 34 deletions(-) diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml index bd7cb46..2eb30dc 100644 --- a/RHEL6/input/auxiliary/nist_support.xml +++ b/RHEL6/input/auxiliary/nist_support.xml @@ -14,7 +14,7 @@ automated means. This requirement is procedural, and can not be met through automated means. - + diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml index 5e22314..aae47d0 100644 --- a/RHEL6/input/profiles/nist-CL-IL-AL.xml +++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml @@ -259,10 +259,7 @@ assurance."