[PATCH v2] Fixed titles for CCEs 14904-7 and 14697-5
Steve Grubb
sgrubb at redhat.com
Thu May 10 15:56:27 UTC 2012
On Thursday, May 10, 2012 11:50:53 AM Jeffrey Blank wrote:
> Not necessarily. There are plenty of files that could qualify
> (including /var/log/tallylog) for being added to this Rule. This is
> really about deciding where to stop / priorities.
Right. In the stig.rules file its commented out. If you are super paranoid you
could use it. This reminds me that it needs updating for pam_faillock...
> This particular Rule does not exist to satisfy a requirement: it is
> really quite optional in itself and fits in the "best practices realm".
> It exists to provide additional information about what may be going on.
> (The actual requirements in OS SRG include auditing login/logout, and
> auditing unsuccessful accesses to files, and we have Rules for those.)
> The stig.rules file in
> /usr/share/doc/audit-VERSION provides explanation.
>
> On 05/08/2012 06:01 PM, Shawn Wells wrote:
> > On 5/4/12 5:43 PM, Michael Palmiotto wrote:
> >> +<Rule id="audit_manual_logon_edits">
> >> +<title> Record Attempts to Alter Logon and Logout Events</title>
> >> +<description>
> >> +The audit system already collects login info for all users and root.
> >> To watch for attempted manual edits of
> >> +files involved in storing logon events, add the following
> >> to<tt>/etc/audit/audit.rules</tt>:
> >> +<pre>
> >> +-w /var/log/faillog -p wa -k logins
> >> +-w /var/log/lastlog -p wa -k logins
> >> +</pre>
> >> +</description>
> >> +<ident cce="14904-7" />
> >> +<oval id="audit_rules_login_events" />
> >> +<ref nist="TODO" />
> >> +</Rule>
> >
> > Based on the <description> shouldn't /var/log/secure be added to the
> > watch list too?
Nothing in syslog is authoritative. It can be spoofed by any application or
user. The audit logs are the only reliable source of security events.
-Steve
More information about the scap-security-guide
mailing list