[PATCH 05/11] Mapped CCI-001686 to met_natively

Shawn Wells shawn at redhat.com
Wed May 16 19:18:07 UTC 2012


This CCI requires that "appropriate individuals" recieve notifications for account terminations. This is provided for natively in the linux audit logs, which are accessible to root (other guidance states that root must review the logs, so I'm considering the fact auditd puts the information there a notification)
---
 rhel6/src/input/auxiliary/srg_support.xml |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
index 5dbdc95..60f003e 100644
--- a/rhel6/src/input/auxiliary/srg_support.xml
+++ b/rhel6/src/input/auxiliary/srg_support.xml
@@ -14,6 +14,15 @@ Red Hat Enterprise Linux meets this requirement by design.
      desired here. -->
 </description>
 <ref disa="131" />
+
+<Rule id="audit_account_termination">
+<title>The operating system must notify, as required, appropriate individuals for account termination.</title>
+<description>Monitoring account termination is critical to ensure a denial of service situation does not exist on the operating system.  An unexpected account termination can also be a sign of a rogue administrator account that may be deleting traces of activity.  In order to facilitate the monitoring, the operating system must notify designated personnel when an account is terminated.</description>
+<rationale>The Red Hat Enterprise Linux Auditing Subsystem provides this functionality natively, placing this information in the audit logs for system administrator review.</rationale>
+<ref disa="1686" />
+</Rule>
+
+
 </Group>
 
 <Group id="unmet_impractical_guidance" hidden="true">
-- 
1.7.1


--u3/rZRmxL6MmkK24--


More information about the scap-security-guide mailing list