On 1/2/13 3:21 PM, David Smith wrote:
Per DISA FSO comments (rows 82-83), moved CCI 000144 to show
permanent finding.
David Smith (1):
moved CCI 144 to permanent finding
RHEL6/input/auxiliary/srg_support.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
Here's what I show as the full language:
The audit system must alert designated staff members when audit storage
volume is full. Administrators should be made aware of an inability to
record audit records. If a separate partition or logical audit storage
volume is full, the SA and other designated staff must be
notified.Sending an email when the volume is filled is not supported by
the RHEL6 auditd service. This requirement is a permanent finding and
cannot be fixed. An appropriate mitigation for the system must be
implemented but this finding cannot be considered fixed. RHEL6 does not
support this requirement. This is a permanent finding. SRG-OS-000049
CCI-000144 AU-5 (2)
The audit system must alert designated staff members when audit storage
volume is generating disk errors. Administrators should be made aware
of an inability to record audit records. If a separate partition or
logical audit storage volume is generating disk errors, the SA and other
designated staff must be notified.Sending an email when the volume is
generating disk errors is not supported by the RHEL6 auditd service.
This requirement is a permanent finding and cannot be fixed. An
appropriate mitigation for the system must be implemented but this
finding cannot be considered fixed. RHEL6 does not support this
requirement. This is a permanent finding. SRG-OS-000049 CCI-000144
AU-5 (2)
Pre-release Draft STIG for RHEL 6 Server
I believe we need to create new rules to meet these. Alerting on storage
errors? Set disk_error_action. When volume full? Set disk_full_action.
http://linux.die.net/man/8/auditd.conf
If you agree I'll open a ticket to track that content creation.