[PATCH 05/24] Updated audit_network_modifications, specifically changed the -k to audit_network_modifications
Shawn Wells
shawn at redhat.com
Wed Feb 22 03:04:22 UTC 2012
---
rhel6/src/input/system/auditing.xml | 14 +++++++-------
1 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 5b3a74b..045cf45 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -193,19 +193,19 @@ to capture events that modify account changes:
<description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
ARCH to either b32 or b64 as appropriate for your system:
<br />
-<pre>
--a exit,always -F arch=ARCH -S sethostname -S setdomainname -k system-locale
--w /etc/issue -p wa -k system-locale
--w /etc/issue.net -p wa -k system-locale
--w /etc/hosts -p wa -k system-locale
--w /etc/sysconfig/network -p wa -k system-locale
+<pre># audit_network_modifications
+-a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
+-w /etc/issue -p wa -k audit_network_modifications
+-w /etc/issue.net -p wa -k audit_network_modifications
+-w /etc/hosts -p wa -k audit_network_modifications
+-w /etc/sysconfig/network -p wa -k audit_network_modifications
</pre>
</description>
<rationale>The network environment should not be modified by anything other than
administrator action. Any change to network parameters should be audited.</rationale>
<ident cce="14816-3" />
<oval id="audit_rules_networkconfig_modification" />
-<ref nist="AU-2" />
+<ref nist="AU-2(a)" />
</Rule>
--
1.7.1
--0F1p//8PRICkK4MW--
More information about the scap-security-guide
mailing list