[PATCH 20/24] Updated audit_sysadmin_actions to watch /etc/sudoers.d/
Shawn Wells
shawn at redhat.com
Sat Feb 25 21:48:47 UTC 2012
---
.../input/checks/audit_rules_sysadmin_actions.xml | 6 ++++++
rhel6/src/input/system/auditing.xml | 5 +++--
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml b/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml
index 1afd221..d0ffeec 100644
--- a/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml
+++ b/rhel6/src/input/checks/audit_rules_sysadmin_actions.xml
@@ -14,10 +14,16 @@
</definition>
<ind:textfilecontent54_test check="all" comment="audit sudoers" id="test_audit_rules_sysadmin_actions" version="1">
<ind:object object_ref="object_audit_rules_sysadmin_actions" />
+ <ind:object object_ref="object_audit_rules_sysadmin_actions_sudoersd" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_audit_rules_sysadmin_actions" version="1">
<ind:filepath>/etc/audit/audit.rules</ind:filepath>
<ind:pattern operation="pattern match">^\-w\s+/etc/sudoers\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+ <ind:textfilecontent54_object id="object_audit_rules_sysadmin_actions_sudoersd" version="1">
+ <ind:filepath>/etc/audit/audit.rules</ind:filepath>
+ <ind:pattern operation="pattern match">^\-w\s+/etc/sudoers.d/\s+\-k\s+[-\w]+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
</def-group>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index d4955a0..6a3a1f0 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -412,8 +412,9 @@ malicious processes that attempt to delete log files to conceal their presence.<
administrator actions for all users and root. Add the following to
<tt>/etc/audit/audit.rules</tt>:
<br />
-<pre>
--w /etc/sudoers -p wa -k actions</pre>
+<pre># audit_sysadmin_actions
+-w /etc/sudoers -p wa -k audit_sysadmin_actions
+-w /etc/sudoers.d/ -k audit_sysadmin_actions</pre>
</description>
<rationale>The actions taken by system administrators should be audited to keep a record
of what was executed on the system as well as for accountability purposes.</rationale>
--
1.7.1
--gBBFr7Ir9EOA20Yy--
More information about the scap-security-guide
mailing list