[PATCH 22/24] Updated audit_login_config to include PAM config - Updated audit_login_config to include PAM configuration files
Shawn Wells
shawn at redhat.com
Sat Feb 25 22:02:50 UTC 2012
---
rhel6/src/input/system/auditing.xml | 11 ++++++++++-
1 files changed, 10 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index fc618d0..a8d7b67 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -196,7 +196,16 @@ to capture events that modify account changes:
-w /etc/securetty -p wa -k audit_login_config
-w /var/run/faillock -p wa -k audit_login_config
-w /var/log/lastlog -p wa -k audit_login_config
--w /var/log/tallylog -p wa -k audit_login_config</pre>
+-w /var/log/tallylog -p wa -k audit_login_config
+-w /etc/pam.d/ -p wa -k audit_login_config
+-w /etc/security/access.conf -p wa -k audit_login_config
+-w /etc/security/limits.conf -p wa -k audit_login_config
+-w /etc/security/pam_env.conf -p wa -k audit_login_config
+-w /etc/security/namespace.conf -p wa -k audit_login_config
+-w /etc/security/namespace.d/ -p wa -k audit_login_config
+-w /etc/security/namespace.init -p wa -k audit_login_config
+-w /etc/security/sepermit.conf -p wa -k audit_login_config
+-w /etc/security/time.conf -p wa -k audit_login_config</pre>
</description>
<rationale>Alterations to login configuration files could indicate malicious intent, such as automatically running an executable upon every users login.</rationale>
<ident cce="TBD" />
--
1.7.1
--zhXaljGHf11kAtnf--
More information about the scap-security-guide
mailing list