>From 433f57ba310b3ffea374225c5a62517de48f5689 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 25 Feb 2012 16:48:47 -0500 Subject: [PATCH 20/24] Updated audit_sysadmin_actions to watch /etc/sudoers.d/ --- .../input/checks/audit_rules_sysadmin_actions.xml | 6 ++++++ rhel6/src/input/system/auditing.xml | 5 +++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml b/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml index 1afd221..d0ffeec 100644 --- a/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml +++ b/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml @@ -14,10 +14,16 @@ + /etc/audit/audit.rules ^\-w\s+/etc/sudoers\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$ 1 + + /etc/audit/audit.rules + ^\-w\s+/etc/sudoers.d/\s+\-k\s+[-\w]+\s*$ + 1 + diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index d4955a0..6a3a1f0 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -412,8 +412,9 @@ malicious processes that attempt to delete log files to conceal their presence.< administrator actions for all users and root. Add the following to /etc/audit/audit.rules:
-
--w /etc/sudoers -p wa -k actions
+
# audit_sysadmin_actions
+-w /etc/sudoers -p wa -k audit_sysadmin_actions
+-w /etc/sudoers.d/ -k audit_sysadmin_actions
The actions taken by system administrators should be audited to keep a record of what was executed on the system as well as for accountability purposes. -- 1.7.1