[PATCH 04/11] Mapped CCI-001684 to audit_account_changes

Shawn Wells shawn at redhat.com
Wed May 16 19:01:53 UTC 2012


This CCI requires that proper notification is given when accounts are modified. The audit subsystem captures such events and places them in the audit logs for sysadmin review.
---
 rhel6/src/input/system/auditing.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index cd23bee..8b9ecd4 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -237,7 +237,7 @@ to capture events that modify account changes:
 <rationale>In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. It is recommended that any unexpected users, groups, or modifications be investigated for legitimacy.</rationale>
 <ident cce="14829-6" />
 <oval id="audit_rules_usergroup_modification" />
-<ref nist="AU-2(a)" disa="18,1403,1404,1405"/>
+<ref nist="AU-2(a)" disa="18,1403,1404,1405, 1684"/>
 </Rule>
 
 <Rule id="audit_network_modifications">
-- 
1.7.1


--n8g4imXOkfNTN/H1--


More information about the scap-security-guide mailing list