[PATCH v2] Fixed titles for CCEs 14904-7 and 14697-5
Michael Palmiotto
mpalmiotto at tresys.com
Fri May 4 21:43:11 UTC 2012
Signed-off-by: Michael Palmiotto <mpalmiotto at tresys.com>
---
.../src/input/checks/audit_rules_login_events.xml | 2 +-
.../input/checks/audit_rules_session_events.xml | 2 +-
rhel6/src/input/profiles/common.xml | 2 +
rhel6/src/input/system/auditing.xml | 30 ++++++++++++++++++++
4 files changed, 34 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/checks/audit_rules_login_events.xml b/rhel6/src/input/checks/audit_rules_login_events.xml
index 77a7661..06bbbff 100644
--- a/rhel6/src/input/checks/audit_rules_login_events.xml
+++ b/rhel6/src/input/checks/audit_rules_login_events.xml
@@ -1,7 +1,7 @@
<def-group>
<definition class="compliance" id="audit_rules_login_events" version="1">
<metadata>
- <title>Audit Logon/Logout Events</title>
+ <title>Record Attempts to Alter Logon and Logout Events</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
diff --git a/rhel6/src/input/checks/audit_rules_session_events.xml b/rhel6/src/input/checks/audit_rules_session_events.xml
index e1dfc43..b3b2595 100644
--- a/rhel6/src/input/checks/audit_rules_session_events.xml
+++ b/rhel6/src/input/checks/audit_rules_session_events.xml
@@ -1,7 +1,7 @@
<def-group>
<definition class="compliance" id="audit_rules_session_events" version="1">
<metadata>
- <title>Audit Session Initiation Information</title>
+ <title>Record Attempts to Alter Process and Session Initiation Information</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index 20853f5..a628a5a 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -88,6 +88,8 @@
<select idref="audit_account_changes" selected="true"/>
<select idref="audit_network_modifications" selected="true"/>
<select idref="audit_mac_changes" selected="true"/>
+<select idref="audit_manual_logon_edits" selected="true" />
+<select idref="audit_manual_session_edits" selected="true" />
<select idref="audit_dac_actions" selected="true"/>
<select idref="audit_file_access" selected="true"/>
<select idref="audit_privileged_commands" selected="true"/>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index c79471f..b54ae64 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -206,6 +206,36 @@ anything other than administrator action. All changes to MAC policy should be au
<ref nist="AU-2" />
</Rule>
+<Rule id="audit_manual_logon_edits">
+<title> Record Attempts to Alter Logon and Logout Events</title>
+<description>
+The audit system already collects login info for all users and root. To watch for attempted manual edits of
+files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/log/faillog -p wa -k logins
+-w /var/log/lastlog -p wa -k logins
+</pre>
+</description>
+<ident cce="14904-7" />
+<oval id="audit_rules_login_events" />
+<ref nist="TODO" />
+</Rule>
+
+<Rule id="audit_manual_session_edits">
+<title> Record Attempts to Alter Process and Session Initiation Information</title>
+<description>
+The audit system already collects process information for all users and root. To watch for attempted manual
+edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/run/utmp -p wa -k session
+-w /var/log/btmp -p wa -k session
+-w /var/log/wtmp -p wa -k session
+</pre>
+</description>
+<ident cce="14679-5" />
+<oval id="audit_rules_session_events" />
+<ref nist="TODO" />
+</Rule>
<Rule id="audit_dac_actions">
<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
--
1.7.6.5
More information about the scap-security-guide
mailing list