[PATCH v2] Fixed titles for CCEs 14904-7 and 14697-5

Shawn Wells shawn at redhat.com
Tue May 8 22:01:22 UTC 2012


On 5/4/12 5:43 PM, Michael Palmiotto wrote:
> +<Rule id="audit_manual_logon_edits">
> +<title>  Record Attempts to Alter Logon and Logout Events</title>
> +<description>
> +The audit system already collects login info for all users and root. To watch for attempted manual edits of
> +files involved in storing logon events, add the following to<tt>/etc/audit/audit.rules</tt>:
> +<pre>
> +-w /var/log/faillog -p wa -k logins
> +-w /var/log/lastlog -p wa -k logins
> +</pre>
> +</description>
> +<ident cce="14904-7" />
> +<oval id="audit_rules_login_events" />
> +<ref nist="TODO" />
> +</Rule>


Based on the <description> shouldn't /var/log/secure be added to the 
watch list too?


More information about the scap-security-guide mailing list