On 11/2/12 12:25 AM, Michele Newman wrote:
---
RHEL6/input/system/auditing.xml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 9e1e1c8..832c760 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -645,8 +645,8 @@ ARCH to either b32 or b64 as appropriate for your system:
<ocil clause="the system isn't configured to audit changes of the network
configuration">
To determine if the system is configured to audit changes to its network
configuration,
run the following command:
-<pre>auditctl -l | egrep
'(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
-If the system is configured to watch for account changes, a line should be returned for
+<pre>auditctl -l | egrep
'(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre>
+If the system is configured to watch for network configuration changes, a line should be
returned for
each file specified (and <tt>perm=wa</tt> should be indicated for each).
</ocil>
<rationale>The network environment should not be modified by anything other
--
Ack. This was really needing to be fixed, thanks!