Received an auto-ACK from Jeff. Going to go ahead and push these commits.
Michael Palmiotto (1):
Fixed titles for CCEs 14904-7 and 14697-5
.../src/input/checks/audit_rules_login_events.xml | 2 +-
.../input/checks/audit_rules_session_events.xml | 2 +-
rhel6/src/input/system/auditing.xml | 30 ++++++++++++++++++++
3 files changed, 32 insertions(+), 2 deletions(-)
--
1.7.6.5
Show replies by date
Signed-off-by: Michael Palmiotto <mpalmiotto(a)tresys.com>
---
.../src/input/checks/audit_rules_login_events.xml | 2 +-
.../input/checks/audit_rules_session_events.xml | 2 +-
rhel6/src/input/system/auditing.xml | 30 ++++++++++++++++++++
3 files changed, 32 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/checks/audit_rules_login_events.xml
b/rhel6/src/input/checks/audit_rules_login_events.xml
index 77a7661..06bbbff 100644
--- a/rhel6/src/input/checks/audit_rules_login_events.xml
+++ b/rhel6/src/input/checks/audit_rules_login_events.xml
@@ -1,7 +1,7 @@
<def-group>
<definition class="compliance" id="audit_rules_login_events"
version="1">
<metadata>
- <title>Audit Logon/Logout Events</title>
+ <title>Record Attempts to Alter Logon and Logout Events</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
diff --git a/rhel6/src/input/checks/audit_rules_session_events.xml
b/rhel6/src/input/checks/audit_rules_session_events.xml
index e1dfc43..b3b2595 100644
--- a/rhel6/src/input/checks/audit_rules_session_events.xml
+++ b/rhel6/src/input/checks/audit_rules_session_events.xml
@@ -1,7 +1,7 @@
<def-group>
<definition class="compliance" id="audit_rules_session_events"
version="1">
<metadata>
- <title>Audit Session Initiation Information</title>
+ <title>Record Attempts to Alter Process and Session Initiation
Information</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index c79471f..b8d4760 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -206,6 +206,36 @@ anything other than administrator action. All changes to MAC policy
should be au
<ref nist="AU-2" />
</Rule>
+<Rule id="audit_manual_logon_edits">
+<title> Record Attempts to Alter Logon and Logout Events</title>
+<description>
+The audit system already collects login info for all users and root. To watch for
attempted manual edits of
+files involved in storing logon events, add the following to
<tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/log/faillog -p wa -k logins
+-w /var/log/lastlog -p wa -k logins
+</pre>
+</description>
+<ident cce="14904-7" />
+<oval id="audit_rules_logon_modification" />
+<ref nist="TODO" />
+</Rule>
+
+<Rule id="audit_manual_session_edits">
+<title> Record Attempts to Alter Process and Session Initiation
Information</title>
+<description>
+The audit system already collects process information for all users and root. To watch
for attempted manual
+edits of files involved in storing such process information, add the following to
<tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/run/utmp -p wa -k session
+-w /var/log/btmp -p wa -k session
+-w /var/log/wtmp -p wa -k session
+</pre>
+</description>
+<ident cce="14679-5" />
+<oval id="audit_rules_session_modification" />
+<ref nist="TODO" />
+</Rule>
<Rule id="audit_dac_actions">
<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
--
1.7.6.5