>From e0e7632949b88ef2a205935fe7d76e954e880fba Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 21 Feb 2012 22:19:01 -0500 Subject: [PATCH 08/11] - Updated audit_unsuccessful_file_access for syntax, chanced -k to audit_unsuccessful_file_access --- rhel6/src/input/system/auditing.xml | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 2e943d8..cb8360c 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -247,8 +247,8 @@ unauthorized users. - -Ensure <tt>auditd</tt> Collects Unauthorized Access Attempts to Files (unsuccessful) + +Ensure <tt>auditd</tt> Collects Unauthorized (unsuccessful) Access Attempts to Files At a minimum the audit system should collect unauthorized file accesses for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as @@ -256,12 +256,12 @@ appropriate for your system:
 -a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \ 
-    -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
+    -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k audit_unsuccessful_file_access
 -a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \
-    -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access
+ -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k audit_unsuccessful_file_access
Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. +these events could serve as evidence of malicious intent and potential system compromise. -- 1.7.1