[PATCH 01/12] Changed content as per ticket #147.

Jeffrey Blank blank at eclipse.ncsc.mil
Fri Dec 7 15:01:03 UTC 2012


Please push this set -- thanks.

Per our conversation with some of the FSO govt folks on Monday, some of
the minor style changes can be at the vendor's (your) discretion; there
is a requirement to conform to certain sentence structures and phrasing
(and some of these may have been identified in the copy editing
patches), but colons vs periods (or other extremely minor items,
presumably contractions too) are at your discretion.  It's desirable to
present configuration actions to admins in the format they'd expect.

Thanks!




On 12/06/2012 07:27 PM, Michele Newman wrote:
> ---
>  RHEL6/input/system/auditing.xml |   48 +++++++++++++++++++-------------------
>  1 files changed, 24 insertions(+), 24 deletions(-)
> 
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index 67cce9a..c14f3dc 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -88,7 +88,7 @@ disk.
>  <service-enable-macro service="auditd" />
>  </description>
>  <ocil><service-enable-check-macro service="auditd" /></ocil>
> -<rationale>Ensuring that the <tt>auditd</tt> service is active ensures that
> +<rationale>Ensuring the <tt>auditd</tt> service is active ensures 
>  audit records generated by the kernel can be written to disk, or that appropriate
>  actions will be taken if other obstacles exist.
>  </rationale>
> @@ -100,7 +100,7 @@ actions will be taken if other obstacles exist.
>  
>  <Rule id="enable_auditd_bootloader" severity="medium">
>  <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
> -<description>To ensure that all processes can be audited, even
> +<description>To ensure all processes can be audited, even
>  those which start prior to the audit daemon, add the argument
>  <tt>audit=1</tt> to the kernel line in <tt>/etc/grub.conf</tt>, in the manner below:
>  <pre>kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1</pre>
> @@ -114,7 +114,7 @@ auditing is enabled at boot time.
>  Each process on the system carries an "auditable" flag which
>  indicates whether its activities can be audited. Although <tt>auditd</tt>
>  takes care of enabling this for all processes which launch after it
> -does, adding the kernel argument ensures that it is set for every
> +does, adding the kernel argument ensures it is set for every
>  process during boot.
>  </rationale>
>  <ident cce="15026-8" />
> @@ -293,7 +293,7 @@ page. These include:
>  Set the <tt><i>ACTION</i></tt> to <tt>rotate</tt> to ensure log rotation
>  occurs.  This is the default.  The setting is case-insensitive.
>  </description>
> -<ocil clause="the system hasn't been properly set up to rotate audit logs">
> +<ocil clause="the system has not been properly set up to rotate audit logs">
>  Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
>  determine if the system is configured to rotate logs when they reach their
>  maximum size: 
> @@ -344,7 +344,7 @@ These include:
>  Set this to <tt>email</tt> (instead of the default,
>  which is <tt>suspend</tt>) as it is more likely to get prompt attention.
>  </description>
> -<ocil clause="the system isn't configured to send an email to the system administrator when
> +<ocil clause="the system is not configured to send an email to the system administrator when
>  disk space is starting to run low">
>  Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
>  determine if the system is configured to email the administrator when
> @@ -383,7 +383,7 @@ mode for corrective action.  For certain systems, the need for availability
>  outweighs the need to log all actions, and a different setting should be
>  determined.
>  </description>
> -<ocil clause="the system isn't configured to switch to single user
> +<ocil clause="the system is not configured to switch to single user
>  mode for corrective action">
>  Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
>  determine if the system is configured to switch to single user mode
> @@ -408,7 +408,7 @@ in <tt>/etc/audit/auditd.conf</tt> to ensure that administrators are notified
>  via email for those situations:
>  <pre>action_mail_acct = root</pre>
>  </description>
> -<ocil clause="auditd isn't configured to send emails per identified actions">
> +<ocil clause="auditd is not configured to send emails per identified actions">
>  Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
>  determine if the system is configured to send email to an
>  account when it needs to notify an administrator:
> @@ -465,7 +465,7 @@ editing as needed, the new rules can be activated as follows:
>  <Group id="audit_time_rules">
>  <title>Records Events that Modify Date and Time Information</title>
>  <description>Arbitrary changes to the system time can be used to obfuscate 
> -nefarious activities in log files as well as to confuse network services that 
> +nefarious activities in log files, as well as to confuse network services that 
>  are highly dependent upon an accurate system time. All changes to the system 
>  time should be audited.</description>
>  
> @@ -484,11 +484,11 @@ desired, but is not required. See an example of multiple combined syscalls:
>  <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
>  -k audit_time_rules</pre>
>  </description>
> -<ocil clause="the system isn't configured to audit time changes">
> +<ocil clause="the system is not configured to audit time changes">
>  <audit-syscall-check-macro syscall="adjtimex" />
>  </ocil>
>  <rationale>Arbitrary changes to the system time can be used to obfuscate 
> -nefarious activities in log files as well as to confuse network services that 
> +nefarious activities in log files, as well as to confuse network services that 
>  are highly dependent upon an accurate system time (such as sshd). All changes 
>  to the system time should be audited.</rationale>
>  <ident cce="14051-7" />
> @@ -512,11 +512,11 @@ desired, but is not required. See an example of multiple combined syscalls:
>  <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
>  -k audit_time_rules</pre>
>  </description>
> -<ocil clause="the system isn't configured to audit time changes">
> +<ocil clause="the system is not configured to audit time changes">
>  <audit-syscall-check-macro syscall="settimeofday" />
>  </ocil>
>  <rationale>Arbitrary changes to the system time can be used to obfuscate 
> -nefarious activities in log files as well as to confuse network services that 
> +nefarious activities in log files, as well as to confuse network services that 
>  are highly dependent upon an accurate system time (such as sshd). All changes 
>  to the system time should be audited.</rationale>
>  <ident cce="14051-7" />
> @@ -538,11 +538,11 @@ See an example of multiple combined syscalls:
>  <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
>  -k audit_time_rules</pre>
>  </description>
> -<ocil clause="the system isn't configured to audit time changes">
> +<ocil clause="the system is not configured to audit time changes">
>  <audit-syscall-check-macro syscall="stime" />
>  </ocil>
>  <rationale>Arbitrary changes to the system time can be used to obfuscate 
> -nefarious activities in log files as well as to confuse network services that 
> +nefarious activities in log files, as well as to confuse network services that 
>  are highly dependent upon an accurate system time (such as sshd). All changes 
>  to the system time should be audited.</rationale>
>  <ident cce="14051-7" />
> @@ -566,11 +566,11 @@ desired, but is not required. See an example of multiple combined syscalls:
>  <pre>-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
>  -k audit_time_rules</pre>
>  </description>
> -<ocil clause="the system isn't configured to audit time changes">
> +<ocil clause="the system is not configured to audit time changes">
>  <audit-syscall-check-macro syscall="clock_settime" />
>  </ocil>
>  <rationale>Arbitrary changes to the system time can be used to obfuscate 
> -nefarious activities in log files as well as to confuse network services that 
> +nefarious activities in log files, as well as to confuse network services that 
>  are highly dependent upon an accurate system time (such as sshd). All changes 
>  to the system time should be audited.</rationale>
>  <ident cce="14051-7" />
> @@ -587,7 +587,7 @@ The -k option allows for the specification of a key in string form that can
>  be used for better reporting capability through ausearch and aureport and
>  should always be used.
>  </description>
> -<ocil clause="the system isn't configured to audit time changes">
> +<ocil clause="the system is not configured to audit time changes">
>  To determine if the system is configured to audit attempts to
>  alter time via the /etc/localtime file, run the following
>  command:
> @@ -595,7 +595,7 @@ command:
>  If the system is configured to audit this activity, it will return a line.
>  </ocil>
>  <rationale>Arbitrary changes to the system time can be used to obfuscate 
> -nefarious activities in log files as well as to confuse network services that 
> +nefarious activities in log files, as well as to confuse network services that 
>  are highly dependent upon an accurate system time (such as sshd). All changes 
>  to the system time should be audited.</rationale>
>  <ident cce="14051-7" />
> @@ -616,7 +616,7 @@ to capture events that modify account changes:
>  -w /etc/shadow -p wa -k audit_account_changes
>  -w /etc/security/opasswd -p wa -k audit_account_changes</pre>
>  </description>
> -<ocil clause="the system isn't configured to audit account changes">
> +<ocil clause="the system is not configured to audit account changes">
>  To determine if the system is configured to audit account changes,
>  run the following command:
>  <pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
> @@ -643,7 +643,7 @@ ARCH to either b32 or b64 as appropriate for your system:
>  -w /etc/hosts -p wa -k audit_network_modifications
>  -w /etc/sysconfig/network -p wa -k audit_network_modifications</pre>
>  </description>
> -<ocil clause="the system isn't configured to audit changes of the network configuration">
> +<ocil clause="the system is not configured to audit changes of the network configuration">
>  To determine if the system is configured to audit changes to its network configuration,
>  run the following command:
>  <pre>auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre>
> @@ -697,7 +697,7 @@ owner, and unauthorized users, potential access to sensitive information.</ratio
>  <description>Add the following to <tt>/etc/audit/audit.rules</tt>:
>  <pre>-w /etc/selinux/ -p wa -k MAC-policy</pre>
>  </description>
> -<ocil clause="the system isn't configured to audit attempts to change the MAC policy">
> +<ocil clause="the system is not configured to audit attempts to change the MAC policy">
>  To determine if the system is configured to audit changes to its SELinux
>  configuration files, run the following command:
>  <pre># auditctl -l | grep "dir=/etc/selinux"</pre>
> @@ -760,7 +760,7 @@ If the system is 64 bit then also add the following:
>  gain access to information that would otherwise be disallowed. Auditing DAC modifications
>  can facilitate the identification of patterns of abuse among both authorized and
>  unauthorized users.</rationale>
> -<ocil clause="the system isn't configured to audit permission changes">
> +<ocil clause="the system is not configured to audit permission changes">
>  <audit-syscall-check-macro syscall="chmod" />
>  </ocil>
>  <warning category="general">Note that these rules can be configured in a 
> @@ -1233,7 +1233,7 @@ appropriate for your system:
>  <audit-syscall-check-macro syscall="renameat" />
>  </ocil>
>  <rationale>Auditing file deletions will create an audit trail for files that are removed
> -from the system. The audit trail could aid in system troubleshooting as well as detecting
> +from the system. The audit trail could aid in system troubleshooting, as well as, detecting
>  malicious processes that attempt to delete log files to conceal their presence.</rationale>
>  <ident cce="14820-5" />
>  <oval id="audit_rules_file_deletion_events" />
> @@ -1252,7 +1252,7 @@ To verify that auditing is configured for system administrator actions, run the
>  <pre># auditctl -l | grep "watch=/etc/sudoers"</pre>
>  </ocil>
>  <rationale>The actions taken by system administrators should be audited to keep a record
> -of what was executed on the system as well as for accountability purposes.</rationale>
> +of what was executed on the system, as well as, for accountability purposes.</rationale>
>  <ident cce="14824-7" />
>  <oval id="audit_rules_sysadmin_actions" />
>  <ref nist="AU-2" disa="126"/>

-- 
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance


More information about the scap-security-guide mailing list