[PATCH 3/3] M1 Incomplete Guidance - Logging and Auditing + profiles/common.xml

Mike Palmiotto mpalmiotto at tresys.com
Tue Apr 10 21:24:43 UTC 2012


From: Michael Palmiotto <mpalmiotto at tresys.com>

---
 .../checks/audit_rules_logon_modification.xml      |   34 +++++++++
 .../checks/audit_rules_session_modification.xml    |   47 ++++++++++++
 .../checks/logwatch_configured_on_logserver.xml    |   71 ++++++++++++++++++
 .../src/input/checks/rsyslog_messages_captured.xml |   70 ++++++++++++++++++
 rhel6/src/input/profiles/common.xml                |   27 +++++++
 rhel6/src/input/system/auditing.xml                |   77 +++++++++++++++++++-
 rhel6/src/input/system/logging.xml                 |   67 +++++++++++++++++
 7 files changed, 392 insertions(+), 1 deletions(-)
 create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification.xml
 create mode 100644 rhel6/src/input/checks/audit_rules_session_modification.xml
 create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserver.xml
 create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml

diff --git a/rhel6/src/input/checks/audit_rules_logon_modification.xml b/rhel6/src/input/checks/audit_rules_logon_modification.xml
new file mode 100644
index 0000000..97d170d
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_logon_modification.xml
@@ -0,0 +1,34 @@
+<def-group>
+  <definition class="compliance" id="audit_rules_logon_modification" version="1">
+    <metadata>
+      <title> Record Attempts to Alter Logon and Logout Events</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id=" CCE-14904-7" source="CCE" />
+      <description> Audit attempted manual edits of files involved in storing logon events.</description>
+    </metadata>
+    <criteria operator = "AND">
+      <criterion comment="watch on lastlog" test_ref="test_audit_rules_logon_modification_lastlog" />
+      <criterion comment="watch on faillog" test_ref="test_audit_rules_logon_modification_faillog" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" comment="lastlog watch" id="test_audit_rules_logon_modification_lastlog" version="1">
+    <ind:object object_ref="object_audit_rules_logon_modification_lastlog" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_audit_rules_logon_modification_lastlog" version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_test check="all" comment="faillog watch" id="test_audit_rules_logon_modification_faillog" version="1">
+    <ind:object object_ref="object_audit_rules_logon_modification_faillog" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_audit_rules_logon_modification_faillog" version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/faillog[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/audit_rules_session_modification.xml b/rhel6/src/input/checks/audit_rules_session_modification.xml
new file mode 100644
index 0000000..22b0cb6
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_session_modification.xml
@@ -0,0 +1,47 @@
+<def-group>
+  <definition class="compliance" id="audit_rules_session_modification" version="1">
+    <metadata>
+      <title></title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-14679-5" source="CCE" />
+      <description>Ensure that watches are placed on utmp, btmp, and wtmp, sessions.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="watch on wtmp" test_ref="test_audit_rules_session_modification_wtmp" />
+      <criterion comment="watch on utmp" test_ref="test_audit_rules_session_modification_utmp" />
+      <criterion comment="watch on btmp" test_ref="test_audit_rules_session_modification_btmp" />
+    </criteria>
+  </definition>
+ 
+ <ind:textfilecontent54_test check="all" comment="wtmp session watch" id="test_audit_rules_session_modification_wtmp" version="1">
+    <ind:object object_ref="object_audit_rules_session_modification_wtmp" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_audit_rules_session_modification_wtmp" version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/wtmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment="utmp session watch" id="test_audit_rules_session_modification_utmp" version="1">
+    <ind:object object_ref="object_audit_rules_session_modification_utmp" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_audit_rules_session_modification_utmp" version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/utmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment="btmp session watch" id="test_audit_rules_session_modification_btmp" version="1">
+    <ind:object object_ref="object_audit_rules_session_modification_btmp" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_audit_rules_session_modification_btmp" version="1">
+    <ind:path>/etc/audit</ind:path>
+    <ind:filename>audit.rules</ind:filename>
+    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/btmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/logwatch_configured_on_logserver.xml b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml
new file mode 100644
index 0000000..2a99b92
--- /dev/null
+++ b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml
@@ -0,0 +1,71 @@
+<def-group>
+  <definition class="compliance" id="logwatch_configured_on_logserver" version="1">
+    <metadata>
+      <title>Ensure Logwatch Configured on the Central Log Server</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-4323-2" source="CCE" />
+      <description>Check if logwatch service is enabled and configured.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="hostlimit" test_ref="test_logwatch_configured_on_logserver_hostlimit" />
+      <criterion comment="splithosts" test_ref="test_logwatch_configured_on_logserver_splithosts" />
+      <criterion comment="multiemail" test_ref="test_logwatch_configured_on_logserver_multiemail" />
+      <criterion comment="service" test_ref="test_logwatch_configured_on_logserver_service" />
+
+    </criteria>
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="test_logwatch_configured_on_logserver_hostlimit" version="1">
+    <ind:object object_ref="object_logwatch_configured_on_logserver_hostlimit" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_hostlimit" version="1">
+    <ind:subexpression operation="equals">no</ind:subexpression>
+  </ind:textfilecontent54_state>
+  <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_hostlimit" version="1">
+    <ind:path>/etc/logwatch/conf</ind:path>
+    <ind:filename>logwatch.conf</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="test_logwatch_configured_on_logserver_splithosts" version="1">
+    <ind:object object_ref="object_logwatch_configured_on_logserver_splithosts" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_splithosts" version="1">
+    <ind:subexpression operation="equals">yes</ind:subexpression>
+  </ind:textfilecontent54_state>
+  <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_splithosts" version="1">
+    <ind:path>/etc/logwatch/conf</ind:path>
+    <ind:filename>logwatch.conf</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object> 
+ 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test MultiEmail" id="test_logwatch_configured_on_logserver_multiemail" version="1">
+    <ind:object object_ref="object_logwatch_configured_on_logserver_multiemail" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_multiemail" version="1">
+    <ind:subexpression operation="equals">no</ind:subexpression>
+  </ind:textfilecontent54_state>
+  <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_multiemail" version="1">
+    <ind:path>/etc/logwatch/conf</ind:path>
+    <ind:filename>logwatch.conf</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]MultiEmail[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+ 
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test Service" id="test_logwatch_configured_on_logserver_service" version="1">
+    <ind:object object_ref="object_logwatch_configured_on_logserver_service" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_service" version="1">
+    <ind:subexpression operation="equals">-zz-disk_space</ind:subexpression>
+  </ind:textfilecontent54_state>
+  <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_service" version="1">
+    <ind:path>/etc/logwatch/conf</ind:path>
+    <ind:filename>logwatch.conf</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]Service[\s]*=[\s]*\-zz\-disk\_space+\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/rsyslog_messages_captured.xml b/rhel6/src/input/checks/rsyslog_messages_captured.xml
new file mode 100644
index 0000000..0639653
--- /dev/null
+++ b/rhel6/src/input/checks/rsyslog_messages_captured.xml
@@ -0,0 +1,70 @@
+<def-group>
+  <definition class="compliance" id="rsyslog_messages_captured"
+  version="1">
+    <metadata>
+      <title>Ensure Important Messages are Captured</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>Make sure appropriate lines are in rsyslog.conf. </description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="messages" test_ref="test_rsyslog_messages_captured_messages" />
+      <criterion comment="kern.log" test_ref="test_rsyslog_messages_captured_kern" />
+      <criterion comment="daemon.log" test_ref="test_rsyslog_messages_captured_daemon" />
+      <criterion comment="syslog" test_ref="test_rsyslog_messages_captured_syslog" />
+      <criterion comment="unused.log" test_ref="test_rsyslog_messages_captured_unused" />
+    </criteria>
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="messages" id="test_rsyslog_messages_captured_messages" version="1">
+    <ind:object object_ref="object_rsyslog_messages_captured_messages" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_messages" version="1">
+    <ind:path>/etc</ind:path>
+    <ind:filename>rsyslog.conf</ind:filename>
+    <ind:pattern operation="pattern match">^auth\.\*[\s]*\,[\s]*user\.\*[\s]+\/var\/log\/messages$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  
+  <ind:textfilecontent54_test check="all" comment="kern.log" id="test_rsyslog_messages_captured_kern" version="1">
+    <ind:object object_ref="object_rsyslog_messages_captured_kern" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_kern" version="1">
+    <ind:path>/etc</ind:path>
+    <ind:filename>rsyslog.conf</ind:filename>
+<ind:pattern operation="pattern match">^kern\.\*[\s]+\/var\/log\/kern\.log$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  
+  <ind:textfilecontent54_test check="all" comment="daemon.log" id="test_rsyslog_messages_captured_daemon" version="1">
+    <ind:object object_ref="object_rsyslog_messages_captured_daemon" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_daemon" version="1">
+    <ind:path>/etc</ind:path>
+    <ind:filename>rsyslog.conf</ind:filename>
+<ind:pattern operation="pattern match">^daemon\.\*[\s]+\/var\/log\/daemon\.log$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  
+  <ind:textfilecontent54_test check="all" comment="syslog" id="test_rsyslog_messages_captured_syslog" version="1">
+    <ind:object object_ref="object_rsyslog_messages_captured_syslog" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_syslog" version="1">
+    <ind:path>/etc</ind:path>
+    <ind:filename>rsyslog.conf</ind:filename>
+ <ind:pattern operation="pattern match">^syslog\.\*[\s]+\/var\/log\/syslog$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  
+  <ind:textfilecontent54_test check="all" comment="unused" id="test_rsyslog_messages_captured_unused" version="1">
+    <ind:object object_ref="object_rsyslog_messages_captured_unused" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_unused" version="1">
+    <ind:path>/etc</ind:path>
+    <ind:filename>rsyslog.conf</ind:filename>
+ <ind:pattern operation="pattern match">^lpr\,news\,uucp\,local0\,local1\,local2\,local3\,local4\,local5\,local6\.\*[\s]+\/var\/log\/unused\.log$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>              
diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index 20853f5..e426f83 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -20,6 +20,17 @@
 <select idref="selinux_unlabeled_device_files" selected="true"/>
 <select idref="restrict_root_console_logins" selected="true"/>
 <select idref="restrict_serial_port_logins" selected="true"/>
+
+<select idref="verify_wheel_exists" selected="true"/>
+<select idref="verify_sudo_audit_trail" selected="true"/>
+<select idref="verify_libuser_login_defs_import" selected="true"/>
+<select idref="verify_libuser_login_defs_userdefaults" selected="true"/>
+<select idref="verify_accounts_disabled_after_expiration" selected="true"/>
+<select idref="pam_ccreds_removed" selected="true"/>
+<select idref="ensure_dot_files_not_world_writable" selected="true" />
+<select idref="ensure_no_netrc_files" selected="true" />
+<select idref="login_shell_inactivity_timeout" selected="true"/>
+
 <select idref="no_shelllogin_for_systemaccounts" selected="true"/>
 <select idref="no_empty_passwords" selected="true"/>
 <select idref="no_hashes_outside_shadow" selected="true"/>
@@ -76,14 +87,18 @@
 <select idref="install_openswan" selected="true"/>
 <select idref="package_rsyslog_installed" selected="true"/>
 <select idref="enable_rsyslog" selected="true"/>
+<select idref="ensure_rsyslog_messages_captured" selected="true"/>
 <select idref="userowner_rsyslog_files" selected="true"/>
 <select idref="groupowner_rsyslog_files" selected="true"/>
 <select idref="rsyslog_file_permissions" selected="true"/>
 <select idref="rsyslog_send_messages_to_logserver" selected="true"/>
 <!-- <select idref="rsyslog_accept_remote_messages" selected="true"/> -->
 <select idref="ensure_logrotate_activated" selected="true"/>
+<select idref="configure_logwatch_on_logserver" selected="true"/>
+<select idref="disable_logwatch_for_logserver" selected="true"/>
 <select idref="enable_auditd_service" selected="true"/>
 <select idref="enable_auditd_bootloader" selected="true"/>
+<select idref="configure_auditd_data_retention" selected="true"/>
 <select idref="audit_time_rules" selected="true"/>
 <select idref="audit_account_changes" selected="true"/>
 <select idref="audit_network_modifications" selected="true"/>
@@ -93,6 +108,8 @@
 <select idref="audit_privileged_commands" selected="true"/>
 <select idref="audit_media_exports" selected="true"/>
 <select idref="audit_file_deletions" selected="true"/>
+<select idref="audit_manual_logon_edits" selected="true"/>
+<select idref="audit_manual_session_edits" selected="true"/>
 <select idref="audit_sysadmin_actions" selected="true"/>
 <select idref="audit_kernel_module_loading" selected="true"/>
 <select idref="audit_config_immutable" selected="true"/>
@@ -165,6 +182,16 @@
 <select idref="disable_smb_server" selected="true"/>
 <select idref="require_smb_client_signing" selected="true"/>
 <select idref="require_smb_client_signing_mount.cifs" selected="true"/>
+<select idref="select_squid_listening_port" selected="true"/>
+<select idref="verify_default_secure_settings" selected="true"/>
+<select idref="change_default_insecure_settings" selected="true"/>
+<select idref="configure_authentication" selected="true"/>
+<select idref="access_control_lists" selected="true"/>
+<select idref="configure_icp" selected="true"/>
+<select idref="allow_proxy_server_access" selected="true"/>
+<select idref="forward_logs_to_syslogd" selected="true"/>
+<select idref="run_squid_in_chroot_jail" selected="true"/>
+<select idref="lower_privileges" selected="true"/>
 <select idref="disable_squid" selected="true"/>
 <select idref="uninstall_squid" selected="true"/>
 <select idref="disable_snmpd" selected="true"/>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index e75754f..1d18eaf 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -95,6 +95,51 @@ process during boot.
 <ref nist="AU-2" />
 </Rule>
 
+<!--
+<Group id="configure_auditd_data_retention">
+<title> Configure <tt>auditd</tt> Data Retention</title>
+<description>
+<ul>
+
+<li> Determine <i>STOREMB</i>, the amount of audit data (in megabytes) which should be retained in each log
+file. Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line:</li>
+<pre>max_log_file = <i>STOREMB</i></tt>
+
+<li>Use a dedicated partition (or logical volume) for log files. It is straightforward to create such a partition
+or logical volume during system installation time. The partition should be larger than the maximum
+space which <tt>auditd</tt> will ever use, which is the maximum size of each log file (<tt>max_log_file</tt>) multiplied
+by the number of log files (<tt>num_logs</tt>). Ensure the partition is mounted on <tt>/var/log/audit</tt>.</li>
+
+<li>If your site requires that the machine be disabled when auditing cannot be performed, configure <tt>auditd</tt>
+to halt the system when disk space for auditing runs low. Edit <tt>/etc/audit/auditd.conf</tt>, and add or
+correct the following lines:</li>
+<pre>space_left_action = email
+action_mail_acct = root
+admin_space_left_action = halt</pre>
+</ul>
+The default action to take when the logs reach their maximum size is to rotate the log files, discarding the
+oldest one. If it is more important to retain all possible auditing information, even if that opens the possibility
+of running out of space and taking the action defined by <tt>admin_space_left_action</tt>, add or correct the line:
+<pre>max_log_file_action = keep_logs</pre>
+By default, <tt>auditd</tt> retains 4 log files of size 5Mb apiece. For a busy system or a system which is thoroughly
+auditing system activity, this is likely to be insuffcient. 
+The log file size needed will depend heavily on what types of events are being audited. First configure auditing
+to log all the events of interest. Then monitor the log size manually for awhile to determine what file size will
+allow you to keep the required data for the correct time period.
+Using a dedicated partition for <tt>/var/log/audit</tt> prevents the <tt>auditd</tt> logs from disrupting system functionality if
+they fill, and, more importantly, prevents other activity in <tt>/var</tt> from filling the partition and stopping the audit
+trail. (The audit logs are size-limited and therefore unlikely to grow without bound unless configured to do so.)
+Some machines may have requirements that no actions occur which cannot be audited. If this is the case, then
+<tt>auditd</tt> can be configured to halt the machine if it runs out of space.  
+<b>Note:</b> Since older logs are rotated, configuring <tt>auditd</tt> this way does not prevent older logs from being rotated
+away before they can be viewed.
+<i>If your system is configured to halt when logging cannot be performed, make sure this can never
+happen under normal circumstances! Ensure that <tt>/var/log/audit</tt> is on its own partition, and
+that this partition is larger than the maximum amount of data <tt>auditd</tt> will retain normally.</i></description>
+<oval id="service_auditd_data_retention_configured" />
+</Group>
+-->
+
 <Group id="auditd_configure_rules">
 <title>Configure <tt>auditd</tt> Rules for Comprehensive Auditing</title>
 <description>The <tt>auditd</tt> program can perform comprehensive
@@ -171,7 +216,6 @@ to capture events that modify account changes:
 <ref nist="AU-2(a)" />
 </Rule>
 
-
 <Rule id="audit_network_modifications">
 <title>Record Events that Modify the System’s Network Environment</title>
 <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
@@ -205,6 +249,37 @@ anything other than administrator action. All changes to MAC policy should be au
 <ref nist="AU-2" />
 </Rule>
 
+<Rule id="audit_manual_logon_edits">
+<title> Record Attempts to Alter Logon and Logout Events</title>
+<description> 
+The audit system already collects login info for all users and root. To watch for attempted manual edits of 
+files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>: 
+<pre>
+-w /var/log/faillog -p wa -k logins 
+-w /var/log/lastlog -p wa -k logins
+</pre>
+</description>
+<ident cce="14904-7" />
+<oval id="audit_rules_logon_modification" />
+<ref nist="TODO" />
+</Rule>
+
+
+<Rule id="audit_manual_session_edits">
+<title> Record Attempts to Alter Process and Session Initiation Information</title>
+<description> 
+The audit system already collects process information for all users and root. To watch for attempted manual 
+edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>: 
+<pre>
+-w /var/run/utmp -p wa -k session 
+-w /var/log/btmp -p wa -k session 
+-w /var/log/wtmp -p wa -k session
+</pre>
+</description>
+<ident cce="14679-5" />
+<oval id="audit_rules_session_modification" />
+<ref nist="TODO" />
+</Rule>
 
 <Rule id="audit_dac_actions">
 <title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/logging.xml
index 839484e..fc6b311 100644
--- a/rhel6/src/input/system/logging.xml
+++ b/rhel6/src/input/system/logging.xml
@@ -54,6 +54,25 @@ logging services.
 <ref nist="AU-2" />
 </Rule>
 
+<Rule id="ensure_rsyslog_messages_captured">
+<title> Ensure Important Messages are Captured</title>
+<description>
+Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct whichever of the following lines are appropriate for your
+environment:
+<pre>
+auth.*,user.*                                                           /var/log/messages
+kern.*                                                                  /var/log/kern.log
+daemon.*                                                                /var/log/daemon.log
+syslog.*                                                                /var/log/syslog
+lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.*        /var/log/unused.log
+</pre>
+See the man page <tt>rsyslog.conf(5)</tt> for more information.
+<i>By default,</i> <tt>rsyslog</tt> <i>uses a timestamp format that Logwatch does not understand. If your en-
+vironment uses Logwatch, edit the file <tt>/etc/rsyslog.conf</tt> and add or edit the following line:</i>
+<pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</pre></description>
+<oval id="rsyslog_messages_captured" />
+</Rule>
+
 <Group id="log_file_permissions">
 <title>Confirm Existence and Permissions of System Log Files</title>
 <description>For each log file LOGFILE referenced in
@@ -297,4 +316,52 @@ if the /var/log partition becomes full.</rationale>
 <ref nist="AU-2, AU-9, CM-6" />
 </Rule>
 </Group>
+
+<Rule id="configure_logwatch_on_logserver">
+<title> Configure Logwatch on the Central Log Server</title>
+<description> 
+Is this machine the central log server? If so, edit the file <tt>/etc/logwatch/conf/logwatch.conf</tt>. Add or 
+correct the following lines:
+<pre> 
+HostLimit = no 
+SplitHosts = yes 
+MultiEmail = no 
+Service = -zz-disk_space 
+</pre>
+Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default): 
+<pre># cd /etc/cron.daily 
+# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch 
+</pre>
+On a central logserver, you want Logwatch to summarize all syslog entries, including those which did not originate 
+on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to report on all hosts, not just the one on which it 
+is running. 
+If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname. This makes the report longer but significantly 
+more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that 
+information is almost always necessary. If <tt>MultiEmail</tt> is set, then each host's information will be sent in a 
+separate e-mail message. This is a matter of preference. 
+The <tt>Service</tt> directive <tt>-zz-disk_space</tt> tells Logwatch not to run the <tt>zz-disk_space</tt> report, which reports on 
+free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be 
+that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note 
+that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible, 
+such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to 
+the logserver.</description>
+<ident cce="4323-2" />
+<oval id="logwatch_configured_on_logserver" />
+</Rule>
+
+
+<Rule id="disable_logwatch_for_logserver">
+<title> Disable Logwatch on Clients if a Logserver Exists</title>
+<description> 
+Does your site have a central logserver which has been configured to report on logs received from all systems? 
+If so:
+<pre> 
+# rm /etc/cron.daily/0logwatch 
+</pre>
+If no logserver exists, it will be necessary for each machine to run Logwatch individually. Using a central 
+logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier 
+and less time-intensive for administrators.</description>
+<oval id="logwatch_disabled_for_logserver" />
+</Rule>
 </Group>
+
-- 
1.7.6.4



More information about the scap-security-guide mailing list