>From 085093c0dec24bef3f6e67684af515047251694f Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 21 Feb 2012 21:59:04 -0500 Subject: [PATCH 03/11] - Updated audit_account_changes to reflect 800-53 subsection - Adjusted audit rules key to -k audit_account_changes - Altered rationale --- rhel6/src/input/system/auditing.xml | 17 ++++++++--------- 1 files changed, 8 insertions(+), 9 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 63dcad4..23d22c5 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -174,18 +174,17 @@ upon an accurate system time (such as sshd). All changes to the system time shou Add the following to /etc/audit/audit.rules, in order to capture events that modify account changes:
-
--w /etc/group -p wa -k identity
--w /etc/passwd -p wa -k identity
--w /etc/gshadow -p wa -k identity
--w /etc/shadow -p wa -k identity
--w /etc/security/opasswd -p wa -k identity
+
#audit_account_changes
+-w /etc/group -p wa -k audit_account_changes
+-w /etc/passwd -p wa -k audit_account_changes
+-w /etc/gshadow -p wa -k audit_account_changes
+-w /etc/shadow -p wa -k audit_account_changes
+-w /etc/security/opasswd -p wa -k audit_account_changes
-New user or group accounts need to be audited to verify that they are legitimate. Any suspect -users or groups should be investigated. +In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. It is recommended that any unexpected users, groups, or modifications be investigated for legitimacy. - + -- 1.7.1