[PATCH 05/24] Updated audit_network_modifications, specifically changed the -k to audit_network_modifications

Shawn Wells shawn at redhat.com
Wed Feb 22 03:04:22 UTC 2012


---
 rhel6/src/input/system/auditing.xml |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 5b3a74b..045cf45 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -193,19 +193,19 @@ to capture events that modify account changes:
 <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
 ARCH to either b32 or b64 as appropriate for your system:
 <br />
-<pre>
--a exit,always -F arch=ARCH -S sethostname -S setdomainname -k system-locale
--w /etc/issue -p wa -k system-locale
--w /etc/issue.net -p wa -k system-locale
--w /etc/hosts -p wa -k system-locale
--w /etc/sysconfig/network -p wa -k system-locale
+<pre># audit_network_modifications
+-a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
+-w /etc/issue -p wa -k audit_network_modifications
+-w /etc/issue.net -p wa -k audit_network_modifications
+-w /etc/hosts -p wa -k audit_network_modifications
+-w /etc/sysconfig/network -p wa -k audit_network_modifications
 </pre>
 </description>
 <rationale>The network environment should not be modified by anything other than
 administrator action. Any change to network parameters should be audited.</rationale>
 <ident cce="14816-3" />
 <oval id="audit_rules_networkconfig_modification" />
-<ref nist="AU-2" />
+<ref nist="AU-2(a)" />
 </Rule>
 
 
-- 
1.7.1


--0F1p//8PRICkK4MW--


More information about the scap-security-guide mailing list