[PATCH 04/10] Fix command was referencing account info not network.

Michele Newman mnewman at redhat.com
Fri Nov 2 04:25:31 UTC 2012


---
 RHEL6/input/system/auditing.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 9e1e1c8..832c760 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -645,8 +645,8 @@ ARCH to either b32 or b64 as appropriate for your system:
 <ocil clause="the system isn't configured to audit changes of the network configuration">
 To determine if the system is configured to audit changes to its network configuration,
 run the following command:
-<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
-If the system is configured to watch for account changes, a line should be returned for
+<pre>auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre>
+If the system is configured to watch for network configuration changes, a line should be returned for
 each file specified (and <tt>perm=wa</tt> should be indicated for each).
 </ocil>
 <rationale>The network environment should not be modified by anything other
-- 
1.8.0



More information about the scap-security-guide mailing list