>From 18ccc88c00af5e5c7c523fe41daf513c576ca8b6 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 25 Feb 2012 15:24:46 -0500 Subject: [PATCH 17/24] Modified audit_network_modifications to watch /etc/sysconfig/network-scripts/ directory - Modified audit_network_modifications to watch /etc/sysconfig/network-scripts/ directory - Updated audit_rules_networkconfig_modification.xml for the check as well --- .../audit_rules_networkconfig_modification.xml | 6 ++++++ rhel6/src/input/system/auditing.xml | 1 + 2 files changed, 7 insertions(+), 0 deletions(-) diff --git a/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml b/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml index 1c6b6b2..dcdf3e6 100644 --- a/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml +++ b/rhel6/src/input/checks/audit_rules_networkconfig_modification.xml @@ -113,4 +113,10 @@ ^\-w\s/etc/sysconfig/network\s\-p\swa\s\-k\ssystem\-locale$ 1 + + /etc/audit + audit.rules + ^\-w\s/etc/sysconfig/network\-scripts/\s\-p\swa\s\-k\ssystem\-locale$ + 1 + diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 6b249b4..887b227 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -246,6 +246,7 @@ ARCH to either b32 or b64 as appropriate for your system: -w /etc/issue.net -p wa -k audit_network_modifications -w /etc/hosts -p wa -k audit_network_modifications -w /etc/sysconfig/network -p wa -k audit_network_modifications +-w /etc/sysconfig/network-scripts/ -p wa -k audit_network_modifications The network environment should not be modified by anything other than -- 1.7.1