>From 287d831392ec8c79ff2407174f57d7fd621e8678 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 21 Feb 2012 22:04:22 -0500 Subject: [PATCH 05/11] Updated audit_network_modifications, specifically changed the -k to audit_network_modifications --- rhel6/src/input/system/auditing.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml index 5b3a74b..045cf45 100644 --- a/rhel6/src/input/system/auditing.xml +++ b/rhel6/src/input/system/auditing.xml @@ -193,19 +193,19 @@ to capture events that modify account changes: Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:
-
--a exit,always -F arch=ARCH -S sethostname -S setdomainname -k system-locale
--w /etc/issue -p wa -k system-locale
--w /etc/issue.net -p wa -k system-locale
--w /etc/hosts -p wa -k system-locale
--w /etc/sysconfig/network -p wa -k system-locale
+
# audit_network_modifications
+-a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
+-w /etc/issue -p wa -k audit_network_modifications
+-w /etc/issue.net -p wa -k audit_network_modifications
+-w /etc/hosts -p wa -k audit_network_modifications
+-w /etc/sysconfig/network -p wa -k audit_network_modifications
 
The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited. - + -- 1.7.1