On 1/2/13 3:14 PM, David Smith wrote:
Signed-off-by: David Smith<dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/system/auditing.xml | 20 ++++++++++++++++++++
1 files changed, 20 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 0b689f1..f53e875 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -422,6 +422,26 @@ administrators of the system, who can take appropriate
action.</rationale>
<ref nist="AU-4, CM-6" disa="139,144" />
</Rule>
+<Rule id="configure_auditd_audispd" severity="medium">
+<title>Configure auditd to use audispd plugin</title>
+<description>To configure the <tt>auditd</tt> service to use the
+<tt>audispd</tt> plugin, set the <tt>active</tt> line in
+<tt>/etc/audisp/plugins.d/syslog.conf</tt> to <tt>yes</tt>.
+Restart the <tt>auditd</tt>service:
+<pre># service auditd restart</pre>
+</description>
+<ocil clause="it is not">
+To verify the audispd plugin is active, run the following command:
+<pre># grep active /etc/audisp/plugins.d/syslog.conf</pre>
+If the plugin is active, the output will show <tt>yes</tt>.
+</ocil>
+<rationale>The auditd service does not include the ability to send audit
+records to a centralized server for management directly. It does, however,
+include an audit event multiplexor plugin (audispd) to pass audit records
+to the local syslog server</rationale>
+<ref nist="AU-3" disa="136" />
+</Rule>
+
</Group>
<Group id="auditd_configure_rules">
-- 1.7.1
Should we also give guidance on /how/ to configure audispd, similar to
the rsyslog guidance of updating rsyslog.conf?