[PATCH] Fixed titles for CCEs 14904-7 and 14697-5

Michael Palmiotto mpalmiotto at tresys.com
Fri May 4 18:52:35 UTC 2012


Signed-off-by: Michael Palmiotto <mpalmiotto at tresys.com>
---
 .../src/input/checks/audit_rules_login_events.xml  |    2 +-
 .../input/checks/audit_rules_session_events.xml    |    2 +-
 rhel6/src/input/system/auditing.xml                |   30 ++++++++++++++++++++
 3 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/rhel6/src/input/checks/audit_rules_login_events.xml b/rhel6/src/input/checks/audit_rules_login_events.xml
index 77a7661..06bbbff 100644
--- a/rhel6/src/input/checks/audit_rules_login_events.xml
+++ b/rhel6/src/input/checks/audit_rules_login_events.xml
@@ -1,7 +1,7 @@
 <def-group>
   <definition class="compliance" id="audit_rules_login_events" version="1">
     <metadata>
-      <title>Audit Logon/Logout Events</title>
+      <title>Record Attempts to Alter Logon and Logout Events</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
diff --git a/rhel6/src/input/checks/audit_rules_session_events.xml b/rhel6/src/input/checks/audit_rules_session_events.xml
index e1dfc43..b3b2595 100644
--- a/rhel6/src/input/checks/audit_rules_session_events.xml
+++ b/rhel6/src/input/checks/audit_rules_session_events.xml
@@ -1,7 +1,7 @@
 <def-group>
   <definition class="compliance" id="audit_rules_session_events" version="1">
     <metadata>
-      <title>Audit Session Initiation Information</title>
+      <title>Record Attempts to Alter Process and Session Initiation Information</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index c79471f..b8d4760 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -206,6 +206,36 @@ anything other than administrator action. All changes to MAC policy should be au
 <ref nist="AU-2" />
 </Rule>
 
+<Rule id="audit_manual_logon_edits">
+<title> Record Attempts to Alter Logon and Logout Events</title>
+<description> 
+The audit system already collects login info for all users and root. To watch for attempted manual edits of
+files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/log/faillog -p wa -k logins 
+-w /var/log/lastlog -p wa -k logins 
+</pre>
+</description> 
+<ident cce="14904-7" />
+<oval id="audit_rules_logon_modification" />
+<ref nist="TODO" />
+</Rule>
+
+<Rule id="audit_manual_session_edits">
+<title> Record Attempts to Alter Process and Session Initiation Information</title>
+<description>
+The audit system already collects process information for all users and root. To watch for attempted manual
+edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/run/utmp -p wa -k session
+-w /var/log/btmp -p wa -k session
+-w /var/log/wtmp -p wa -k session
+</pre>
+</description>
+<ident cce="14679-5" />
+<oval id="audit_rules_session_modification" />
+<ref nist="TODO" />
+</Rule>
 
 <Rule id="audit_dac_actions">
 <title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
-- 
1.7.6.5



More information about the scap-security-guide mailing list