[PATCH 05/17] Mapped audit_sysadmin_actions to AC-2(7)(b)
Shawn Wells
shawn.d.wells at gmail.com
Tue Jan 1 17:05:07 UTC 2013
-------------- next part --------------
>From d42cbb03638de2c1e9fcbe218a6e11b81cb9d6eb Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Tue, 25 Dec 2012 15:47:55 -0500
Subject: [PATCH 05/17] Mapped audit_sysadmin_actions to AC-2(7)(b)
Req calls for tracking/monitoring privileged role assignments,
which is done through sudoers
---
RHEL6/input/system/auditing.xml | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 1decfed..847a3cb 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -630,7 +630,7 @@ unexpected users, groups, or modifications should be investigated for
legitimacy.</rationale>
<ident cce="26664-3" />
<oval id="audit_rules_usergroup_modification" />
-<ref nist="AU-2" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
+<ref nist="AC-2(4),AU-2" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
</Rule>
<Rule id="audit_network_modifications">
@@ -1256,7 +1256,7 @@ To verify that auditing is configured for system administrator actions, run the
of what was executed on the system, as well as, for accountability purposes.</rationale>
<ident cce="26662-7" />
<oval id="audit_rules_sysadmin_actions" />
-<ref nist="AU-2" disa="126"/>
+<ref nist="AC-2(7)(b),AU-2" disa="126"/>
<tested by="DS" on="20121024"/>
</Rule>
--
1.7.1
More information about the scap-security-guide
mailing list