On 1/2/13 1:09 PM, David Smith wrote:
Signed-off-by: David Smith<dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/system/auditing.xml | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 1decfed..0b689f1 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -93,7 +93,7 @@ actions will be taken if other obstacles exist.
</rationale>
<ident cce="27058-7" />
<oval id="service_auditd_enabled" />
-<ref nist="AU-1, CM-6"
disa="347,169,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589"
/>
+<ref nist="AU-1, CM-6"
disa="347,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589"
/>
<tested by="DS" on="20121024"/>
</Rule>
@@ -397,7 +397,7 @@ audit records. If a separate partition or logical volume of adequate
size
is used, running low on space for audit records should never occur.
</rationale>
<oval id="auditd_data_retention_admin_space_left_action"
value="var_auditd_admin_space_left_action" />
-<ref nist="AU-4, CM-6" disa="140,143,1343" />
+<ref nist="AU-4, CM-6" disa="140,1343" />
<tested by="DS" on="20121024"/>
</Rule>
I'm not convinced dropping CCI 169 is a good idea.
Other audit related rules say the system must be "configured" in a
certain way, however CCI 169 states auditing must be *enforced*. I've
personally ran into shops who "configured" auditing against
requirements, but didn't have it "enforcing" since they interpreted the
guidance as allowing them to run with auditd stopped.
This file conflicts with my own changes so I went ahead and merged your
deletion into my patchset since Jeff already ack'd this.... but I do
want to specifically bring it up for discussion.