On 7/6/12 2:58 PM, Willy Santos wrote:
CCI-001395 requires notifying the user of org-defined security-related changes to the user's account. This mapping is a request for input/discussion.

Signed-off-by: Willy Santos <wsantos@redhat.com>
---
 rhel6/src/input/auxiliary/srg_support.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
index 7000b12..48fca75 100644
--- a/rhel6/src/input/auxiliary/srg_support.xml
+++ b/rhel6/src/input/auxiliary/srg_support.xml
@@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
 <description>
 It is unclear how to satisfy this requirement.
 </description>
-<ref disa="20,31,218,219,224,1097,1158,1291,1294,1295" />
+<ref disa="20,31,218,219,224,1097,1158,1291,1294,1295,1395" />
 </Group> <!-- end requirement_unclear -->
 
 <Group id="new_rule_needed">

SRG-OS-000235 CCI-001395 The operating system must notify the user of organization-defined security-related changes to the user’s account that occur during the organization-defined time period. Some organizations may define certain security events as events requiring user notification. An organization may define an event such as a password change to a user's account occurring outside of normal business hours as a security related event that requires the user be notified. In those instances where organizations define such events, the operating system must notify the affected user or users.

for now, unmet_impractical_product. There are IDS/audit log watchers (snort, etc) for this.

*technically* we can update the users shell profile to run an aureport on any activity between their last login and the present time, however that would be a bit of a hack.

If this is going to be important we should open up an RFE to get this functionality included in RHEL. It didn't come up during the RHEL7 planning meetings, so to set expectations, there's pretty much no way this would happen until a few service packs into RHEL7.