[PATCH 17/21] Mapped CCI-000018 to audit_account_changes

Shawn Wells shawn at redhat.com
Tue Apr 24 20:07:22 UTC 2012


This CCI requires auditing of account creation. This is automatically done to /var/log/secure, but that assumes users utilize appropriate tools. We also add a watch on /etc/shadow and /etc/passwd via audit_account_changes, so I'm putting this CCI here.
---
 rhel6/src/input/system/auditing.xml |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 8f33e56..5580421 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -186,6 +186,7 @@ to capture events that modify account changes:
 <ident cci="CCI-001403" />
 <ident cci="CCI-001404" />
 <ident cci="CCI-001405" />
+<ident cci="CCI-000018" />
 </Rule>
 
 
-- 
1.7.1


--LZvS9be/3tNcYl/X--


More information about the scap-security-guide mailing list