[PATCH 03/11] - Updated audit_account_changes to reflect 800-53 subsection - Adjusted audit rules key to -k audit_account_changes - Altered rationale

Shawn Wells shawn at redhat.com
Wed Feb 22 02:59:04 UTC 2012


---
 rhel6/src/input/system/auditing.xml |   17 ++++++++---------
 1 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 63dcad4..23d22c5 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -174,18 +174,17 @@ upon an accurate system time (such as sshd). All changes to the system time shou
 <description>Add the following to <tt>/etc/audit/audit.rules</tt>, in order
 to capture events that modify account changes:
 <br />
-<pre>
--w /etc/group -p wa -k identity
--w /etc/passwd -p wa -k identity
--w /etc/gshadow -p wa -k identity
--w /etc/shadow -p wa -k identity
--w /etc/security/opasswd -p wa -k identity</pre>
+<pre>#audit_account_changes
+-w /etc/group -p wa -k audit_account_changes
+-w /etc/passwd -p wa -k audit_account_changes
+-w /etc/gshadow -p wa -k audit_account_changes
+-w /etc/shadow -p wa -k audit_account_changes
+-w /etc/security/opasswd -p wa -k audit_account_changes</pre>
 </description>
-<rationale>New user or group accounts need to be audited to verify that they are legitimate. Any suspect
-users or groups should be investigated.</rationale>
+<rationale>In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. It is recommended that any unexpected users, groups, or modifications be investigated for legitimacy.</rationale>
 <ident cce="14829-6" />
 <oval id="audit_rules_usergroup_modification" />
-<ref nist="AU-2" />
+<ref nist="AU-2(a)" />
 </Rule>
 
 
-- 
1.7.1


--------------060800070900020403020501--


More information about the scap-security-guide mailing list