[PATCH 2/2] added new rule for audispd use

Shawn Wells shawn at redhat.com
Wed Jan 2 23:17:56 UTC 2013


On 1/2/13 3:14 PM, David Smith wrote:
> Signed-off-by: David Smith<dsmith at eclipse.ncsc.mil>
> ---
>   RHEL6/input/system/auditing.xml |   20 ++++++++++++++++++++
>   1 files changed, 20 insertions(+), 0 deletions(-)
>
> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
> index 0b689f1..f53e875 100644
> --- a/RHEL6/input/system/auditing.xml
> +++ b/RHEL6/input/system/auditing.xml
> @@ -422,6 +422,26 @@ administrators of the system, who can take appropriate action.</rationale>
>   <ref nist="AU-4, CM-6" disa="139,144" />
>   </Rule>
>   
> +<Rule id="configure_auditd_audispd" severity="medium">
> +<title>Configure auditd to use audispd plugin</title>
> +<description>To configure the <tt>auditd</tt> service to use the
> +<tt>audispd</tt> plugin, set the <tt>active</tt> line in
> +<tt>/etc/audisp/plugins.d/syslog.conf</tt> to <tt>yes</tt>.
> +Restart the <tt>auditd</tt>service:
> +<pre># service auditd restart</pre>
> +</description>
> +<ocil clause="it is not">
> +To verify the audispd plugin is active, run the following command:
> +<pre># grep active /etc/audisp/plugins.d/syslog.conf</pre>
> +If the plugin is active, the output will show <tt>yes</tt>.
> +</ocil>
> +<rationale>The auditd service does not include the ability to send audit
> +records to a centralized server for management directly.  It does, however,
> +include an audit event multiplexor plugin (audispd) to pass audit records
> +to the local syslog server</rationale>
> +<ref nist="AU-3" disa="136" />
> +</Rule>
> +
>   </Group>
>   
>   <Group id="auditd_configure_rules">
> -- 1.7.1



Should we also give guidance on /how/ to configure audispd, similar to 
the rsyslog guidance of updating rsyslog.conf?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130102/9c516cb6/attachment.html>


More information about the scap-security-guide mailing list