[PATCH 04/10] Fix command was referencing account info not network.

Shawn Wells shawn at redhat.com
Sat Nov 3 02:22:47 UTC 2012


On 11/2/12 12:25 AM, Michele Newman wrote:
> ---
>   RHEL6/input/system/auditing.xml | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index 9e1e1c8..832c760 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -645,8 +645,8 @@ ARCH to either b32 or b64 as appropriate for your system:
>   <ocil clause="the system isn't configured to audit changes of the network configuration">
>   To determine if the system is configured to audit changes to its network configuration,
>   run the following command:
> -<pre>auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'</pre>
> -If the system is configured to watch for account changes, a line should be returned for
> +<pre>auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre>
> +If the system is configured to watch for network configuration changes, a line should be returned for
>   each file specified (and <tt>perm=wa</tt> should be indicated for each).
>   </ocil>
>   <rationale>The network environment should not be modified by anything other
> -- 1.8.0
Ack


More information about the scap-security-guide mailing list