[PATCH 09/64] Mapped configure_auditd_action_mail_acct to AU-5(a)

Shawn Wells shawn.d.wells at gmail.com
Fri Apr 26 02:05:24 UTC 2013


-------------- next part --------------
>From 4572421402925f8edd77044bd643b87451e85a20 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 13:53:28 -0400
Subject: [PATCH 09/64] Mapped configure_auditd_action_mail_acct to AU-5(a)
 AU-5(a) calls for alerting sysadmins in event of audit failure

---
 RHEL6/input/system/auditing.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 17a7230..3b76096 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -424,7 +424,7 @@ account when it needs to notify an administrator:
 administrators of the system, who can take appropriate action.</rationale>
 <ident cce="27241-9" />
 <oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
-<ref nist="AU-1(b),AU-4" disa="139,144" />
+<ref nist="AU-1(b),AU-4,AU-5(a)" disa="139,144" />
 </Rule>
 
 <Rule id="configure_auditd_audispd" severity="medium">
-- 
1.7.1



More information about the scap-security-guide mailing list