[PATCH 09/64] Mapped configure_auditd_action_mail_acct to AU-5(a)
Shawn Wells
shawn.d.wells at gmail.com
Fri Apr 26 02:05:24 UTC 2013
-------------- next part --------------
>From 4572421402925f8edd77044bd643b87451e85a20 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 13:53:28 -0400
Subject: [PATCH 09/64] Mapped configure_auditd_action_mail_acct to AU-5(a)
AU-5(a) calls for alerting sysadmins in event of audit failure
---
RHEL6/input/system/auditing.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 17a7230..3b76096 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -424,7 +424,7 @@ account when it needs to notify an administrator:
administrators of the system, who can take appropriate action.</rationale>
<ident cce="27241-9" />
<oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
-<ref nist="AU-1(b),AU-4" disa="139,144" />
+<ref nist="AU-1(b),AU-4,AU-5(a)" disa="139,144" />
</Rule>
<Rule id="configure_auditd_audispd" severity="medium">
--
1.7.1
More information about the scap-security-guide
mailing list