[PATCH v2 2/2] M1 Incomplete Guidance - Logging and Auditing

Jeffrey Blank blank at eclipse.ncsc.mil
Fri May 4 00:06:41 UTC 2012


Ah -- we already have an auditing check for CCEs 14904-7 and 14679-5,
but they're wrong (and based on a since-corrected release of the guide).
Thanks for the catch.

The old/wrong version had confused:

"Ensure auditd Collects Logon and Logout Events"
with
"Record Attempts to Alter Logon and Logout Events"

as well as

"Ensure auditd Collects Process and Session Initiation Information"
with
"Record Attempts to Alter Process and Session Initiation Information"

The second item in each is correct (as you have it).  Could you alter
the existing, incorrect XCCDF and OVAL rules instead?  I believe that
the text/title is wrong in the existing checks, but that that actual
regex is correct/preferable; we do not want to force admins to call
their key/label for an audit rule a particular thing.  (They can call it
whatever they'd like.)  If you can make those mods, please consider this
an auto-ACK for a commit/push (and also please post to the list).


The logwatch stuff mostly looks good, although I think we should break
apart (into separate Rules/checks) each line for:
HostLimit = no
SplitHosts = yes

The other lines don't seem as security/accountability relevant, and
might be appropriate for discussion only in a Group (if at all).


For the Rules about rsyslog, I would prefer not to try to tell people
how to how to configure their rsyslog.conf.  Creating a Rule+check
implies that that's what we're trying to do.  So, these things are
really better as Groups.

Auditd data retention is quite an interesting section.  Amazingly, I am
actually going to suggest that it be broken apart, and some of it turned
into Rules.  I believe there is a requirement in the DISA OS SRG about
disabling the system, if auditing becomes inoperative.  Maybe take a
look at the output of "make table-srgmap"
(output/rhel6-table-srgmap.html) and see what this says we should make
some rules for?  It might be along the lines of CCI-001343/SRG-OS-000213.

I know I owe you review on some more patches -- thanks for the
contributions.




On 04/25/2012 09:21 AM, Michael Palmiotto wrote:
> 
> Signed-off-by: Mike Palmiotto <mpalmiotto at tresys.com>
> ---
>  .../checks/audit_rules_logon_modification.xml      |   34 +++++++++
>  .../checks/audit_rules_session_modification.xml    |   47 ++++++++++++
>  .../checks/logwatch_configured_on_logserver.xml    |   71 ++++++++++++++++++
>  .../src/input/checks/rsyslog_messages_captured.xml |   70 ++++++++++++++++++
>  rhel6/src/input/system/auditing.xml                |   77 +++++++++++++++++++-
>  rhel6/src/input/system/logging.xml                 |   67 +++++++++++++++++
>  6 files changed, 365 insertions(+), 1 deletions(-)
>  create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification.xml
>  create mode 100644 rhel6/src/input/checks/audit_rules_session_modification.xml
>  create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserver.xml
>  create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml
> 
> diff --git a/rhel6/src/input/checks/audit_rules_logon_modification.xml b/rhel6/src/input/checks/audit_rules_logon_modification.xml
> new file mode 100644
> index 0000000..97d170d
> --- /dev/null
> +++ b/rhel6/src/input/checks/audit_rules_logon_modification.xml
> @@ -0,0 +1,34 @@
> +<def-group>
> +  <definition class="compliance" id="audit_rules_logon_modification" version="1">
> +    <metadata>
> +      <title> Record Attempts to Alter Logon and Logout Events</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id=" CCE-14904-7" source="CCE" />
> +      <description> Audit attempted manual edits of files involved in storing logon events.</description>
> +    </metadata>
> +    <criteria operator = "AND">
> +      <criterion comment="watch on lastlog" test_ref="test_audit_rules_logon_modification_lastlog" />
> +      <criterion comment="watch on faillog" test_ref="test_audit_rules_logon_modification_faillog" />
> +    </criteria>
> +  </definition>
> +  <ind:textfilecontent54_test check="all" comment="lastlog watch" id="test_audit_rules_logon_modification_lastlog" version="1">
> +    <ind:object object_ref="object_audit_rules_logon_modification_lastlog" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_audit_rules_logon_modification_lastlog" version="1">
> +    <ind:path>/etc/audit</ind:path>
> +    <ind:filename>audit.rules</ind:filename>
> +    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +  <ind:textfilecontent54_test check="all" comment="faillog watch" id="test_audit_rules_logon_modification_faillog" version="1">
> +    <ind:object object_ref="object_audit_rules_logon_modification_faillog" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_audit_rules_logon_modification_faillog" version="1">
> +    <ind:path>/etc/audit</ind:path>
> +    <ind:filename>audit.rules</ind:filename>
> +    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/faillog[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/rhel6/src/input/checks/audit_rules_session_modification.xml b/rhel6/src/input/checks/audit_rules_session_modification.xml
> new file mode 100644
> index 0000000..22b0cb6
> --- /dev/null
> +++ b/rhel6/src/input/checks/audit_rules_session_modification.xml
> @@ -0,0 +1,47 @@
> +<def-group>
> +  <definition class="compliance" id="audit_rules_session_modification" version="1">
> +    <metadata>
> +      <title></title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="CCE-14679-5" source="CCE" />
> +      <description>Ensure that watches are placed on utmp, btmp, and wtmp, sessions.</description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion comment="watch on wtmp" test_ref="test_audit_rules_session_modification_wtmp" />
> +      <criterion comment="watch on utmp" test_ref="test_audit_rules_session_modification_utmp" />
> +      <criterion comment="watch on btmp" test_ref="test_audit_rules_session_modification_btmp" />
> +    </criteria>
> +  </definition>
> + 
> + <ind:textfilecontent54_test check="all" comment="wtmp session watch" id="test_audit_rules_session_modification_wtmp" version="1">
> +    <ind:object object_ref="object_audit_rules_session_modification_wtmp" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_audit_rules_session_modification_wtmp" version="1">
> +    <ind:path>/etc/audit</ind:path>
> +    <ind:filename>audit.rules</ind:filename>
> +    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/wtmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +  <ind:textfilecontent54_test check="all" comment="utmp session watch" id="test_audit_rules_session_modification_utmp" version="1">
> +    <ind:object object_ref="object_audit_rules_session_modification_utmp" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_audit_rules_session_modification_utmp" version="1">
> +    <ind:path>/etc/audit</ind:path>
> +    <ind:filename>audit.rules</ind:filename>
> +    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/utmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +  <ind:textfilecontent54_test check="all" comment="btmp session watch" id="test_audit_rules_session_modification_btmp" version="1">
> +    <ind:object object_ref="object_audit_rules_session_modification_btmp" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_audit_rules_session_modification_btmp" version="1">
> +    <ind:path>/etc/audit</ind:path>
> +    <ind:filename>audit.rules</ind:filename>
> +    <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/btmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/rhel6/src/input/checks/logwatch_configured_on_logserver.xml b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml
> new file mode 100644
> index 0000000..2a99b92
> --- /dev/null
> +++ b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml
> @@ -0,0 +1,71 @@
> +<def-group>
> +  <definition class="compliance" id="logwatch_configured_on_logserver" version="1">
> +    <metadata>
> +      <title>Ensure Logwatch Configured on the Central Log Server</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="CCE-4323-2" source="CCE" />
> +      <description>Check if logwatch service is enabled and configured.</description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion comment="hostlimit" test_ref="test_logwatch_configured_on_logserver_hostlimit" />
> +      <criterion comment="splithosts" test_ref="test_logwatch_configured_on_logserver_splithosts" />
> +      <criterion comment="multiemail" test_ref="test_logwatch_configured_on_logserver_multiemail" />
> +      <criterion comment="service" test_ref="test_logwatch_configured_on_logserver_service" />
> +
> +    </criteria>
> +  </definition>
> +  
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="test_logwatch_configured_on_logserver_hostlimit" version="1">
> +    <ind:object object_ref="object_logwatch_configured_on_logserver_hostlimit" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_hostlimit" version="1">
> +    <ind:subexpression operation="equals">no</ind:subexpression>
> +  </ind:textfilecontent54_state>
> +  <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_hostlimit" version="1">
> +    <ind:path>/etc/logwatch/conf</ind:path>
> +    <ind:filename>logwatch.conf</ind:filename>
> +    <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*[\w]+\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="test_logwatch_configured_on_logserver_splithosts" version="1">
> +    <ind:object object_ref="object_logwatch_configured_on_logserver_splithosts" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_splithosts" version="1">
> +    <ind:subexpression operation="equals">yes</ind:subexpression>
> +  </ind:textfilecontent54_state>
> +  <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_splithosts" version="1">
> +    <ind:path>/etc/logwatch/conf</ind:path>
> +    <ind:filename>logwatch.conf</ind:filename>
> +    <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*[\w]+\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object> 
> + 
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test MultiEmail" id="test_logwatch_configured_on_logserver_multiemail" version="1">
> +    <ind:object object_ref="object_logwatch_configured_on_logserver_multiemail" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_multiemail" version="1">
> +    <ind:subexpression operation="equals">no</ind:subexpression>
> +  </ind:textfilecontent54_state>
> +  <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_multiemail" version="1">
> +    <ind:path>/etc/logwatch/conf</ind:path>
> +    <ind:filename>logwatch.conf</ind:filename>
> +    <ind:pattern operation="pattern match">^[\s]MultiEmail[\s]*=[\s]*[\w]+\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> + 
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test Service" id="test_logwatch_configured_on_logserver_service" version="1">
> +    <ind:object object_ref="object_logwatch_configured_on_logserver_service" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_state id="state_logwatch_configured_on_logserver_service" version="1">
> +    <ind:subexpression operation="equals">-zz-disk_space</ind:subexpression>
> +  </ind:textfilecontent54_state>
> +  <ind:textfilecontent54_object id="object_logwatch_configured_on_logserver_service" version="1">
> +    <ind:path>/etc/logwatch/conf</ind:path>
> +    <ind:filename>logwatch.conf</ind:filename>
> +    <ind:pattern operation="pattern match">^[\s]Service[\s]*=[\s]*\-zz\-disk\_space+\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/rhel6/src/input/checks/rsyslog_messages_captured.xml b/rhel6/src/input/checks/rsyslog_messages_captured.xml
> new file mode 100644
> index 0000000..0639653
> --- /dev/null
> +++ b/rhel6/src/input/checks/rsyslog_messages_captured.xml
> @@ -0,0 +1,70 @@
> +<def-group>
> +  <definition class="compliance" id="rsyslog_messages_captured"
> +  version="1">
> +    <metadata>
> +      <title>Ensure Important Messages are Captured</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="TODO" source="CCE" />
> +      <description>Make sure appropriate lines are in rsyslog.conf. </description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion comment="messages" test_ref="test_rsyslog_messages_captured_messages" />
> +      <criterion comment="kern.log" test_ref="test_rsyslog_messages_captured_kern" />
> +      <criterion comment="daemon.log" test_ref="test_rsyslog_messages_captured_daemon" />
> +      <criterion comment="syslog" test_ref="test_rsyslog_messages_captured_syslog" />
> +      <criterion comment="unused.log" test_ref="test_rsyslog_messages_captured_unused" />
> +    </criteria>
> +  </definition>
> +  
> +  <ind:textfilecontent54_test check="all" comment="messages" id="test_rsyslog_messages_captured_messages" version="1">
> +    <ind:object object_ref="object_rsyslog_messages_captured_messages" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_messages" version="1">
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>rsyslog.conf</ind:filename>
> +    <ind:pattern operation="pattern match">^auth\.\*[\s]*\,[\s]*user\.\*[\s]+\/var\/log\/messages$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +  
> +  <ind:textfilecontent54_test check="all" comment="kern.log" id="test_rsyslog_messages_captured_kern" version="1">
> +    <ind:object object_ref="object_rsyslog_messages_captured_kern" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_kern" version="1">
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>rsyslog.conf</ind:filename>
> +<ind:pattern operation="pattern match">^kern\.\*[\s]+\/var\/log\/kern\.log$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +  
> +  <ind:textfilecontent54_test check="all" comment="daemon.log" id="test_rsyslog_messages_captured_daemon" version="1">
> +    <ind:object object_ref="object_rsyslog_messages_captured_daemon" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_daemon" version="1">
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>rsyslog.conf</ind:filename>
> +<ind:pattern operation="pattern match">^daemon\.\*[\s]+\/var\/log\/daemon\.log$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +  
> +  <ind:textfilecontent54_test check="all" comment="syslog" id="test_rsyslog_messages_captured_syslog" version="1">
> +    <ind:object object_ref="object_rsyslog_messages_captured_syslog" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_syslog" version="1">
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>rsyslog.conf</ind:filename>
> + <ind:pattern operation="pattern match">^syslog\.\*[\s]+\/var\/log\/syslog$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +  
> +  <ind:textfilecontent54_test check="all" comment="unused" id="test_rsyslog_messages_captured_unused" version="1">
> +    <ind:object object_ref="object_rsyslog_messages_captured_unused" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_rsyslog_messages_captured_unused" version="1">
> +    <ind:path>/etc</ind:path>
> +    <ind:filename>rsyslog.conf</ind:filename>
> + <ind:pattern operation="pattern match">^lpr\,news\,uucp\,local0\,local1\,local2\,local3\,local4\,local5\,local6\.\*[\s]+\/var\/log\/unused\.log$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>              
> diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
> index e75754f..1d18eaf 100644
> --- a/rhel6/src/input/system/auditing.xml
> +++ b/rhel6/src/input/system/auditing.xml
> @@ -95,6 +95,51 @@ process during boot.
>  <ref nist="AU-2" />
>  </Rule>
>  
> +<!--
> +<Group id="configure_auditd_data_retention">
> +<title> Configure <tt>auditd</tt> Data Retention</title>
> +<description>
> +<ul>
> +
> +<li> Determine <i>STOREMB</i>, the amount of audit data (in megabytes) which should be retained in each log
> +file. Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line:</li>
> +<pre>max_log_file = <i>STOREMB</i></tt>
> +
> +<li>Use a dedicated partition (or logical volume) for log files. It is straightforward to create such a partition
> +or logical volume during system installation time. The partition should be larger than the maximum
> +space which <tt>auditd</tt> will ever use, which is the maximum size of each log file (<tt>max_log_file</tt>) multiplied
> +by the number of log files (<tt>num_logs</tt>). Ensure the partition is mounted on <tt>/var/log/audit</tt>.</li>
> +
> +<li>If your site requires that the machine be disabled when auditing cannot be performed, configure <tt>auditd</tt>
> +to halt the system when disk space for auditing runs low. Edit <tt>/etc/audit/auditd.conf</tt>, and add or
> +correct the following lines:</li>
> +<pre>space_left_action = email
> +action_mail_acct = root
> +admin_space_left_action = halt</pre>
> +</ul>
> +The default action to take when the logs reach their maximum size is to rotate the log files, discarding the
> +oldest one. If it is more important to retain all possible auditing information, even if that opens the possibility
> +of running out of space and taking the action defined by <tt>admin_space_left_action</tt>, add or correct the line:
> +<pre>max_log_file_action = keep_logs</pre>
> +By default, <tt>auditd</tt> retains 4 log files of size 5Mb apiece. For a busy system or a system which is thoroughly
> +auditing system activity, this is likely to be insuffcient. 
> +The log file size needed will depend heavily on what types of events are being audited. First configure auditing
> +to log all the events of interest. Then monitor the log size manually for awhile to determine what file size will
> +allow you to keep the required data for the correct time period.
> +Using a dedicated partition for <tt>/var/log/audit</tt> prevents the <tt>auditd</tt> logs from disrupting system functionality if
> +they fill, and, more importantly, prevents other activity in <tt>/var</tt> from filling the partition and stopping the audit
> +trail. (The audit logs are size-limited and therefore unlikely to grow without bound unless configured to do so.)
> +Some machines may have requirements that no actions occur which cannot be audited. If this is the case, then
> +<tt>auditd</tt> can be configured to halt the machine if it runs out of space.  
> +<b>Note:</b> Since older logs are rotated, configuring <tt>auditd</tt> this way does not prevent older logs from being rotated
> +away before they can be viewed.
> +<i>If your system is configured to halt when logging cannot be performed, make sure this can never
> +happen under normal circumstances! Ensure that <tt>/var/log/audit</tt> is on its own partition, and
> +that this partition is larger than the maximum amount of data <tt>auditd</tt> will retain normally.</i></description>
> +<oval id="service_auditd_data_retention_configured" />
> +</Group>
> +-->
> +
>  <Group id="auditd_configure_rules">
>  <title>Configure <tt>auditd</tt> Rules for Comprehensive Auditing</title>
>  <description>The <tt>auditd</tt> program can perform comprehensive
> @@ -171,7 +216,6 @@ to capture events that modify account changes:
>  <ref nist="AU-2(a)" />
>  </Rule>
>  
> -
>  <Rule id="audit_network_modifications">
>  <title>Record Events that Modify the System’s Network Environment</title>
>  <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
> @@ -205,6 +249,37 @@ anything other than administrator action. All changes to MAC policy should be au
>  <ref nist="AU-2" />
>  </Rule>
>  
> +<Rule id="audit_manual_logon_edits">
> +<title> Record Attempts to Alter Logon and Logout Events</title>
> +<description> 
> +The audit system already collects login info for all users and root. To watch for attempted manual edits of 
> +files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>: 
> +<pre>
> +-w /var/log/faillog -p wa -k logins 
> +-w /var/log/lastlog -p wa -k logins
> +</pre>
> +</description>
> +<ident cce="14904-7" />
> +<oval id="audit_rules_logon_modification" />
> +<ref nist="TODO" />
> +</Rule>
> +
> +
> +<Rule id="audit_manual_session_edits">
> +<title> Record Attempts to Alter Process and Session Initiation Information</title>
> +<description> 
> +The audit system already collects process information for all users and root. To watch for attempted manual 
> +edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>: 
> +<pre>
> +-w /var/run/utmp -p wa -k session 
> +-w /var/log/btmp -p wa -k session 
> +-w /var/log/wtmp -p wa -k session
> +</pre>
> +</description>
> +<ident cce="14679-5" />
> +<oval id="audit_rules_session_modification" />
> +<ref nist="TODO" />
> +</Rule>
>  
>  <Rule id="audit_dac_actions">
>  <title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
> diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/logging.xml
> index 839484e..fc6b311 100644
> --- a/rhel6/src/input/system/logging.xml
> +++ b/rhel6/src/input/system/logging.xml
> @@ -54,6 +54,25 @@ logging services.
>  <ref nist="AU-2" />
>  </Rule>
>  
> +<Rule id="ensure_rsyslog_messages_captured">
> +<title> Ensure Important Messages are Captured</title>
> +<description>
> +Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct whichever of the following lines are appropriate for your
> +environment:
> +<pre>
> +auth.*,user.*                                                           /var/log/messages
> +kern.*                                                                  /var/log/kern.log
> +daemon.*                                                                /var/log/daemon.log
> +syslog.*                                                                /var/log/syslog
> +lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.*        /var/log/unused.log
> +</pre>
> +See the man page <tt>rsyslog.conf(5)</tt> for more information.
> +<i>By default,</i> <tt>rsyslog</tt> <i>uses a timestamp format that Logwatch does not understand. If your en-
> +vironment uses Logwatch, edit the file <tt>/etc/rsyslog.conf</tt> and add or edit the following line:</i>
> +<pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</pre></description>
> +<oval id="rsyslog_messages_captured" />
> +</Rule>
> +
>  <Group id="log_file_permissions">
>  <title>Confirm Existence and Permissions of System Log Files</title>
>  <description>For each log file LOGFILE referenced in
> @@ -297,4 +316,52 @@ if the /var/log partition becomes full.</rationale>
>  <ref nist="AU-2, AU-9, CM-6" />
>  </Rule>
>  </Group>
> +
> +<Rule id="configure_logwatch_on_logserver">
> +<title> Configure Logwatch on the Central Log Server</title>
> +<description> 
> +Is this machine the central log server? If so, edit the file <tt>/etc/logwatch/conf/logwatch.conf</tt>. Add or 
> +correct the following lines:
> +<pre> 
> +HostLimit = no 
> +SplitHosts = yes 
> +MultiEmail = no 
> +Service = -zz-disk_space 
> +</pre>
> +Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default): 
> +<pre># cd /etc/cron.daily 
> +# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch 
> +</pre>
> +On a central logserver, you want Logwatch to summarize all syslog entries, including those which did not originate 
> +on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to report on all hosts, not just the one on which it 
> +is running. 
> +If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname. This makes the report longer but significantly 
> +more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that 
> +information is almost always necessary. If <tt>MultiEmail</tt> is set, then each host's information will be sent in a 
> +separate e-mail message. This is a matter of preference. 
> +The <tt>Service</tt> directive <tt>-zz-disk_space</tt> tells Logwatch not to run the <tt>zz-disk_space</tt> report, which reports on 
> +free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be 
> +that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note 
> +that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible, 
> +such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to 
> +the logserver.</description>
> +<ident cce="4323-2" />
> +<oval id="logwatch_configured_on_logserver" />
> +</Rule>
> +
> +
> +<Rule id="disable_logwatch_for_logserver">
> +<title> Disable Logwatch on Clients if a Logserver Exists</title>
> +<description> 
> +Does your site have a central logserver which has been configured to report on logs received from all systems? 
> +If so:
> +<pre> 
> +# rm /etc/cron.daily/0logwatch 
> +</pre>
> +If no logserver exists, it will be necessary for each machine to run Logwatch individually. Using a central 
> +logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier 
> +and less time-intensive for administrators.</description>
> +<oval id="logwatch_disabled_for_logserver" />
> +</Rule>
>  </Group>
> +


More information about the scap-security-guide mailing list