[PATCH v2 2/2] M1 Incomplete Guidance - Logging and Auditing
Michael Palmiotto
mpalmiotto at tresys.com
Wed Apr 25 13:21:36 UTC 2012
Signed-off-by: Mike Palmiotto <mpalmiotto at tresys.com>
---
.../checks/audit_rules_logon_modification.xml | 34 +++++++++
.../checks/audit_rules_session_modification.xml | 47 ++++++++++++
.../checks/logwatch_configured_on_logserver.xml | 71 ++++++++++++++++++
.../src/input/checks/rsyslog_messages_captured.xml | 70 ++++++++++++++++++
rhel6/src/input/system/auditing.xml | 77 +++++++++++++++++++-
rhel6/src/input/system/logging.xml | 67 +++++++++++++++++
6 files changed, 365 insertions(+), 1 deletions(-)
create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification.xml
create mode 100644 rhel6/src/input/checks/audit_rules_session_modification.xml
create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserver.xml
create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml
diff --git a/rhel6/src/input/checks/audit_rules_logon_modification.xml b/rhel6/src/input/checks/audit_rules_logon_modification.xml
new file mode 100644
index 0000000..97d170d
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_logon_modification.xml
@@ -0,0 +1,34 @@
+<def-group>
+ <definition class="compliance" id="audit_rules_logon_modification" version="1">
+ <metadata>
+ <title> Record Attempts to Alter Logon and Logout Events</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id=" CCE-14904-7" source="CCE" />
+ <description> Audit attempted manual edits of files involved in storing logon events.</description>
+ </metadata>
+ <criteria operator = "AND">
+ <criterion comment="watch on lastlog" test_ref="test_audit_rules_logon_modification_lastlog" />
+ <criterion comment="watch on faillog" test_ref="test_audit_rules_logon_modification_faillog" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" comment="lastlog watch" id="test_audit_rules_logon_modification_lastlog" version="1">
+ <ind:object object_ref="object_audit_rules_logon_modification_lastlog" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_audit_rules_logon_modification_lastlog" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+ <ind:textfilecontent54_test check="all" comment="faillog watch" id="test_audit_rules_logon_modification_faillog" version="1">
+ <ind:object object_ref="object_audit_rules_logon_modification_faillog" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_audit_rules_logon_modification_faillog" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/faillog[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/audit_rules_session_modification.xml b/rhel6/src/input/checks/audit_rules_session_modification.xml
new file mode 100644
index 0000000..22b0cb6
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_session_modification.xml
@@ -0,0 +1,47 @@
+<def-group>
+ <definition class="compliance" id="audit_rules_session_modification" version="1">
+ <metadata>
+ <title></title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-14679-5" source="CCE" />
+ <description>Ensure that watches are placed on utmp, btmp, and wtmp, sessions.</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="watch on wtmp" test_ref="test_audit_rules_session_modification_wtmp" />
+ <criterion comment="watch on utmp" test_ref="test_audit_rules_session_modification_utmp" />
+ <criterion comment="watch on btmp" test_ref="test_audit_rules_session_modification_btmp" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="wtmp session watch" id="test_audit_rules_session_modification_wtmp" version="1">
+ <ind:object object_ref="object_audit_rules_session_modification_wtmp" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_audit_rules_session_modification_wtmp" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/wtmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="utmp session watch" id="test_audit_rules_session_modification_utmp" version="1">
+ <ind:object object_ref="object_audit_rules_session_modification_utmp" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_audit_rules_session_modification_utmp" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/utmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="btmp session watch" id="test_audit_rules_session_modification_btmp" version="1">
+ <ind:object object_ref="object_audit_rules_session_modification_btmp" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_audit_rules_session_modification_btmp" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/btmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/logwatch_configured_on_logserver.xml b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml
new file mode 100644
index 0000000..2a99b92
--- /dev/null
+++ b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml
@@ -0,0 +1,71 @@
+<def-group>
+ <definition class="compliance" id="logwatch_configured_on_logserver" version="1">
+ <metadata>
+ <title>Ensure Logwatch Configured on the Central Log Server</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-4323-2" source="CCE" />
+ <description>Check if logwatch service is enabled and configured.</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="hostlimit" test_ref="test_logwatch_configured_on_logserver_hostlimit" />
+ <criterion comment="splithosts" test_ref="test_logwatch_configured_on_logserver_splithosts" />
+ <criterion comment="multiemail" test_ref="test_logwatch_configured_on_logserver_multiemail" />
+ <criterion comment="service" test_ref="test_logwatch_configured_on_logserver_service" />
+
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="test_logwatch_configured_on_logserver_hostlimit" version="1">
+ <ind:object object_ref="object_logwatch_configured_on_logserver_hostlimit" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_hostlimit" version="1">
+ <ind:subexpression operation="equals">no</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_hostlimit" version="1">
+ <ind:path>/etc/logwatch/conf</ind:path>
+ <ind:filename>logwatch.conf</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="test_logwatch_configured_on_logserver_splithosts" version="1">
+ <ind:object object_ref="object_logwatch_configured_on_logserver_splithosts" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_splithosts" version="1">
+ <ind:subexpression operation="equals">yes</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_splithosts" version="1">
+ <ind:path>/etc/logwatch/conf</ind:path>
+ <ind:filename>logwatch.conf</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test MultiEmail" id="test_logwatch_configured_on_logserver_multiemail" version="1">
+ <ind:object object_ref="object_logwatch_configured_on_logserver_multiemail" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_multiemail" version="1">
+ <ind:subexpression operation="equals">no</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_multiemail" version="1">
+ <ind:path>/etc/logwatch/conf</ind:path>
+ <ind:filename>logwatch.conf</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]MultiEmail[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test Service" id="test_logwatch_configured_on_logserver_service" version="1">
+ <ind:object object_ref="object_logwatch_configured_on_logserver_service" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_service" version="1">
+ <ind:subexpression operation="equals">-zz-disk_space</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_service" version="1">
+ <ind:path>/etc/logwatch/conf</ind:path>
+ <ind:filename>logwatch.conf</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]Service[\s]*=[\s]*\-zz\-disk\_space+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/rsyslog_messages_captured.xml b/rhel6/src/input/checks/rsyslog_messages_captured.xml
new file mode 100644
index 0000000..0639653
--- /dev/null
+++ b/rhel6/src/input/checks/rsyslog_messages_captured.xml
@@ -0,0 +1,70 @@
+<def-group>
+ <definition class="compliance" id="rsyslog_messages_captured"
+ version="1">
+ <metadata>
+ <title>Ensure Important Messages are Captured</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>Make sure appropriate lines are in rsyslog.conf. </description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="messages" test_ref="test_rsyslog_messages_captured_messages" />
+ <criterion comment="kern.log" test_ref="test_rsyslog_messages_captured_kern" />
+ <criterion comment="daemon.log" test_ref="test_rsyslog_messages_captured_daemon" />
+ <criterion comment="syslog" test_ref="test_rsyslog_messages_captured_syslog" />
+ <criterion comment="unused.log" test_ref="test_rsyslog_messages_captured_unused" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="messages" id="test_rsyslog_messages_captured_messages" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_messages" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_rsyslog_messages_captured_messages" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+ <ind:pattern operation="pattern match">^auth\.\*[\s]*\,[\s]*user\.\*[\s]+\/var\/log\/messages$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="kern.log" id="test_rsyslog_messages_captured_kern" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_kern" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_rsyslog_messages_captured_kern" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+<ind:pattern operation="pattern match">^kern\.\*[\s]+\/var\/log\/kern\.log$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="daemon.log" id="test_rsyslog_messages_captured_daemon" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_daemon" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_rsyslog_messages_captured_daemon" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+<ind:pattern operation="pattern match">^daemon\.\*[\s]+\/var\/log\/daemon\.log$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="syslog" id="test_rsyslog_messages_captured_syslog" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_syslog" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_rsyslog_messages_captured_syslog" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+ <ind:pattern operation="pattern match">^syslog\.\*[\s]+\/var\/log\/syslog$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="unused" id="test_rsyslog_messages_captured_unused" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_unused" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_rsyslog_messages_captured_unused" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+ <ind:pattern operation="pattern match">^lpr\,news\,uucp\,local0\,local1\,local2\,local3\,local4\,local5\,local6\.\*[\s]+\/var\/log\/unused\.log$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index e75754f..1d18eaf 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -95,6 +95,51 @@ process during boot.
<ref nist="AU-2" />
</Rule>
+<!--
+<Group id="configure_auditd_data_retention">
+<title> Configure <tt>auditd</tt> Data Retention</title>
+<description>
+<ul>
+
+<li> Determine <i>STOREMB</i>, the amount of audit data (in megabytes) which should be retained in each log
+file. Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line:</li>
+<pre>max_log_file = <i>STOREMB</i></tt>
+
+<li>Use a dedicated partition (or logical volume) for log files. It is straightforward to create such a partition
+or logical volume during system installation time. The partition should be larger than the maximum
+space which <tt>auditd</tt> will ever use, which is the maximum size of each log file (<tt>max_log_file</tt>) multiplied
+by the number of log files (<tt>num_logs</tt>). Ensure the partition is mounted on <tt>/var/log/audit</tt>.</li>
+
+<li>If your site requires that the machine be disabled when auditing cannot be performed, configure <tt>auditd</tt>
+to halt the system when disk space for auditing runs low. Edit <tt>/etc/audit/auditd.conf</tt>, and add or
+correct the following lines:</li>
+<pre>space_left_action = email
+action_mail_acct = root
+admin_space_left_action = halt</pre>
+</ul>
+The default action to take when the logs reach their maximum size is to rotate the log files, discarding the
+oldest one. If it is more important to retain all possible auditing information, even if that opens the possibility
+of running out of space and taking the action defined by <tt>admin_space_left_action</tt>, add or correct the line:
+<pre>max_log_file_action = keep_logs</pre>
+By default, <tt>auditd</tt> retains 4 log files of size 5Mb apiece. For a busy system or a system which is thoroughly
+auditing system activity, this is likely to be insuffcient.
+The log file size needed will depend heavily on what types of events are being audited. First configure auditing
+to log all the events of interest. Then monitor the log size manually for awhile to determine what file size will
+allow you to keep the required data for the correct time period.
+Using a dedicated partition for <tt>/var/log/audit</tt> prevents the <tt>auditd</tt> logs from disrupting system functionality if
+they fill, and, more importantly, prevents other activity in <tt>/var</tt> from filling the partition and stopping the audit
+trail. (The audit logs are size-limited and therefore unlikely to grow without bound unless configured to do so.)
+Some machines may have requirements that no actions occur which cannot be audited. If this is the case, then
+<tt>auditd</tt> can be configured to halt the machine if it runs out of space.
+<b>Note:</b> Since older logs are rotated, configuring <tt>auditd</tt> this way does not prevent older logs from being rotated
+away before they can be viewed.
+<i>If your system is configured to halt when logging cannot be performed, make sure this can never
+happen under normal circumstances! Ensure that <tt>/var/log/audit</tt> is on its own partition, and
+that this partition is larger than the maximum amount of data <tt>auditd</tt> will retain normally.</i></description>
+<oval id="service_auditd_data_retention_configured" />
+</Group>
+-->
+
<Group id="auditd_configure_rules">
<title>Configure <tt>auditd</tt> Rules for Comprehensive Auditing</title>
<description>The <tt>auditd</tt> program can perform comprehensive
@@ -171,7 +216,6 @@ to capture events that modify account changes:
<ref nist="AU-2(a)" />
</Rule>
-
<Rule id="audit_network_modifications">
<title>Record Events that Modify the System’s Network Environment</title>
<description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
@@ -205,6 +249,37 @@ anything other than administrator action. All changes to MAC policy should be au
<ref nist="AU-2" />
</Rule>
+<Rule id="audit_manual_logon_edits">
+<title> Record Attempts to Alter Logon and Logout Events</title>
+<description>
+The audit system already collects login info for all users and root. To watch for attempted manual edits of
+files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/log/faillog -p wa -k logins
+-w /var/log/lastlog -p wa -k logins
+</pre>
+</description>
+<ident cce="14904-7" />
+<oval id="audit_rules_logon_modification" />
+<ref nist="TODO" />
+</Rule>
+
+
+<Rule id="audit_manual_session_edits">
+<title> Record Attempts to Alter Process and Session Initiation Information</title>
+<description>
+The audit system already collects process information for all users and root. To watch for attempted manual
+edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/run/utmp -p wa -k session
+-w /var/log/btmp -p wa -k session
+-w /var/log/wtmp -p wa -k session
+</pre>
+</description>
+<ident cce="14679-5" />
+<oval id="audit_rules_session_modification" />
+<ref nist="TODO" />
+</Rule>
<Rule id="audit_dac_actions">
<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/logging.xml
index 839484e..fc6b311 100644
--- a/rhel6/src/input/system/logging.xml
+++ b/rhel6/src/input/system/logging.xml
@@ -54,6 +54,25 @@ logging services.
<ref nist="AU-2" />
</Rule>
+<Rule id="ensure_rsyslog_messages_captured">
+<title> Ensure Important Messages are Captured</title>
+<description>
+Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct whichever of the following lines are appropriate for your
+environment:
+<pre>
+auth.*,user.* /var/log/messages
+kern.* /var/log/kern.log
+daemon.* /var/log/daemon.log
+syslog.* /var/log/syslog
+lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.* /var/log/unused.log
+</pre>
+See the man page <tt>rsyslog.conf(5)</tt> for more information.
+<i>By default,</i> <tt>rsyslog</tt> <i>uses a timestamp format that Logwatch does not understand. If your en-
+vironment uses Logwatch, edit the file <tt>/etc/rsyslog.conf</tt> and add or edit the following line:</i>
+<pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</pre></description>
+<oval id="rsyslog_messages_captured" />
+</Rule>
+
<Group id="log_file_permissions">
<title>Confirm Existence and Permissions of System Log Files</title>
<description>For each log file LOGFILE referenced in
@@ -297,4 +316,52 @@ if the /var/log partition becomes full.</rationale>
<ref nist="AU-2, AU-9, CM-6" />
</Rule>
</Group>
+
+<Rule id="configure_logwatch_on_logserver">
+<title> Configure Logwatch on the Central Log Server</title>
+<description>
+Is this machine the central log server? If so, edit the file <tt>/etc/logwatch/conf/logwatch.conf</tt>. Add or
+correct the following lines:
+<pre>
+HostLimit = no
+SplitHosts = yes
+MultiEmail = no
+Service = -zz-disk_space
+</pre>
+Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default):
+<pre># cd /etc/cron.daily
+# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch
+</pre>
+On a central logserver, you want Logwatch to summarize all syslog entries, including those which did not originate
+on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to report on all hosts, not just the one on which it
+is running.
+If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname. This makes the report longer but significantly
+more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that
+information is almost always necessary. If <tt>MultiEmail</tt> is set, then each host's information will be sent in a
+separate e-mail message. This is a matter of preference.
+The <tt>Service</tt> directive <tt>-zz-disk_space</tt> tells Logwatch not to run the <tt>zz-disk_space</tt> report, which reports on
+free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be
+that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note
+that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible,
+such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to
+the logserver.</description>
+<ident cce="4323-2" />
+<oval id="logwatch_configured_on_logserver" />
+</Rule>
+
+
+<Rule id="disable_logwatch_for_logserver">
+<title> Disable Logwatch on Clients if a Logserver Exists</title>
+<description>
+Does your site have a central logserver which has been configured to report on logs received from all systems?
+If so:
+<pre>
+# rm /etc/cron.daily/0logwatch
+</pre>
+If no logserver exists, it will be necessary for each machine to run Logwatch individually. Using a central
+logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier
+and less time-intensive for administrators.</description>
+<oval id="logwatch_disabled_for_logserver" />
+</Rule>
</Group>
+
--
1.7.6.5
More information about the scap-security-guide
mailing list