[PATCH 02/20] Mapped AU-1(b)
Shawn Wells
shawn.d.wells at gmail.com
Sat Jan 12 18:18:23 UTC 2013
-------------- next part --------------
>From 41a5457372c218ac5c6c93033086ff10e2c96a7f Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 10 Jan 2013 07:09:01 -0500
Subject: [PATCH 02/20] Mapped AU-1(b)
AU-1(b) calls for "... procedures to facilitate the implimentation of the audit and accountability policy....,"
thus maps to all the rules within our all audit section
---
RHEL6/input/profiles/nist-CL-IL-AL.xml | 12 +++++
RHEL6/input/system/auditing.xml | 84 +++++++++++++++----------------
2 files changed, 53 insertions(+), 43 deletions(-)
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 49375ce..5e22314 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -249,6 +249,18 @@ assurance."</description>
<select idref="service_autofs_disabled" selected="true" \>
<select idref="gconf_gnome_disable_automount" selected="true" \>
+<!-- AU-1(b) -->
+<select idref="configure_auditd_num_logs" selected="true" \>
+<select idref="configure_auditd_max_log_file" selected="true" \>
+<select idref="configure_auditd_max_log_file_action" selected="true" \>
+<select idref="configure_auditd_space_left_action" selected="true" \>
+<select idref="configure_auditd_admin_space_left_action" selected="true" \>
+<select idref="configure_auditd_action_mail_acct" selected="true" \>
+<select idref="configure_auditd_audispd" selected="true" \>
+
+
+
+
<!-- REMAINING MAPPINGS
AU-1
AU-2
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 4a09e60..a05a2b7 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -93,7 +93,7 @@ actions will be taken if other obstacles exist.
</rationale>
<ident cce="27058-7" />
<oval id="service_auditd_enabled" />
-<ref nist="AC-17(1),AU-1, CM-6" disa="347,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
+<ref nist="AC-17(1),AU-1(b), CM-6" disa="347,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -118,7 +118,7 @@ process during boot.
</rationale>
<ident cce="26785-6" />
<oval id="bootloader_audit_argument" />
-<ref nist="AC-17(1),AU-2" disa="1464,130" />
+<ref nist="AC-17(1),AU-1(b),AU-2" disa="1464,130" />
</Rule>
<Group id="configure_auditd_data_retention">
@@ -246,11 +246,10 @@ determine how many logs the system is configured to retain after rotation:
log information over the period required. This is a function of the maximum log
file size and the number of logs retained.</rationale>
<oval id="auditd_data_retention_num_logs" value="var_auditd_num_logs" />
-<ref nist="AU-11, CM-6" />
+<ref nist="AU-1(b),AU-11,CM-6" />
<tested by="DS" on="20121024"/>
</Rule>
-
<Rule id="configure_auditd_max_log_file" severity="medium">
<title>Configure auditd Max Log File Size</title>
<description>Determine the amount of audit data (in megabytes)
@@ -271,11 +270,10 @@ determine how much data the system will retain in each audit log file:
log information over the period required. This is a function of the maximum
log file size and the number of logs retained.</rationale>
<oval id="auditd_data_retention_max_log_file" value="var_auditd_max_log_file" />
-<ref nist="AU-11, CM-6" />
+<ref nist="AU-1(b),AU-11,CM-6" />
<tested by="DS" on="20121024"/>
</Rule>
-
<Rule id="configure_auditd_max_log_file_action" severity="medium">
<title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title>
<description> The default action to take when the logs reach their maximum size
@@ -307,7 +305,7 @@ being overwhelmed with log data. However, for systems that must never discard
log data, or which use external processes to transfer it and reclaim space,
<tt>keep_logs</tt> can be employed.</rationale>
<oval id="auditd_data_retention_max_log_file_action" value="var_auditd_max_log_file_action" />
-<ref nist="AU-4, AU-11, CM-6" />
+<ref nist="AU-1(b),AU-4,AU-11,CM-6" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -357,7 +355,7 @@ disk space is starting to run low:
<rationale>Notifying administrators of an impending disk space problem may
allow them to take corrective action prior to any disruption.</rationale>
<oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
-<ref nist="AU-4, CM-6" disa="140,143,1339" />
+<ref nist="AU-1(b),AU-4,CM-6" disa="140,143,1339" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -397,7 +395,7 @@ audit records. If a separate partition or logical volume of adequate size
is used, running low on space for audit records should never occur.
</rationale>
<oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
-<ref nist="AU-4, CM-6" disa="140,1343" />
+<ref nist="AU-1(b),AU-4,CM-6" disa="140,1343" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -419,7 +417,7 @@ account when it needs to notify an administrator:
<rationale>Email sent to the root account is typically aliased to the
administrators of the system, who can take appropriate action.</rationale>
<oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
-<ref nist="AU-4, CM-6" disa="139,144" />
+<ref nist="AU-1(b),AU-4,CM-6" disa="139,144" />
</Rule>
<Rule id="configure_auditd_audispd" severity="medium">
@@ -439,7 +437,7 @@ If the plugin is active, the output will show <tt>yes</tt>.
records to a centralized server for management directly. It does, however,
include an audit event multiplexor plugin (audispd) to pass audit records
to the local syslog server</rationale>
-<ref nist="AU-3" disa="136" />
+<ref nist="AU-1(b),AU-3" disa="136" />
</Rule>
</Group>
@@ -514,7 +512,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="26242-8" />
<oval id="audit_rules_time_adjtimex" />
-<ref nist="AU-2,AC-17(7)" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
<ref disa="1487,169" />
</Rule>
@@ -542,7 +540,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="27203-9" />
<oval id="audit_rules_time_settimeofday" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
<ref disa="1487,169" />
</Rule>
@@ -568,7 +566,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="27169-2" />
<oval id="audit_rules_time_stime" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
<ref disa="1487,169" />
</Rule>
@@ -596,7 +594,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="27170-0" />
<oval id="audit_rules_time_clock_settime" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
<ref disa="1487,169" />
</Rule>
@@ -621,7 +619,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
<ident cce="27172-6" />
<oval id="audit_rules_time_watch_localtime" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
<ref disa="1487,169" />
</Rule>
</Group><!--End <Group id="audit_time_rules"> -->
@@ -650,7 +648,7 @@ unexpected users, groups, or modifications should be investigated for
legitimacy.</rationale>
<ident cce="26664-3" />
<oval id="audit_rules_usergroup_modification" />
-<ref nist="AC-2(4),AC-17(7),AU-2" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
+<ref nist="AC-2(4),AC-17(7),AU-1(b),AU-2" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
</Rule>
<Rule id="audit_network_modifications">
@@ -676,7 +674,7 @@ than administrator action. Any change to network parameters should be
audited.</rationale>
<ident cce="26648-6" />
<oval id="audit_rules_networkconfig_modification" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
</Rule>
<Rule id="audit_logs_permissions">
@@ -694,7 +692,7 @@ Audit logs must be mode 0640 or less permissive.
If users can write to audit logs, audit trails can be modified or destroyed.
</rationale>
<oval id="file_permissions_var_log_audit" />
-<ref nist="AC-6,AU-9" disa="166" />
+<ref nist="AC-6,AU-1(b),AU-9" disa="166" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -709,7 +707,7 @@ If users can write to audit logs, audit trails can be modified or destroyed.
<rationale>Failure to give ownership of the audit log file(s) to root allows the designated
owner, and unauthorized users, potential access to sensitive information.</rationale>
<oval id="file_ownership_var_log_audit" />
-<ref nist="AC-6,AU-9" disa="166" />
+<ref nist="AC-6,AU-1(b),AU-9" disa="166" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -731,7 +729,7 @@ arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</rationale>
<ident cce="26657-7" />
<oval id="audit_rules_mac_modification" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
</Rule>
<Group id="audit_dac_actions">
@@ -791,7 +789,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="26280-8" />
<oval id="audit_rules_dac_modification_chmod" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_chown">
@@ -819,7 +817,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27173-4" />
<oval id="audit_rules_dac_modification_chown" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_fchmod">
@@ -847,7 +845,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27174-2" />
<oval id="audit_rules_dac_modification_fchmod" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_fchmodat">
@@ -875,7 +873,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27175-9" />
<oval id="audit_rules_dac_modification_fchmodat" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_fchown">
@@ -903,7 +901,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27177-5" />
<oval id="audit_rules_dac_modification_fchown" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_fchownat">
@@ -931,7 +929,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27178-3" />
<oval id="audit_rules_dac_modification_fchownat" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_fremovexattr">
@@ -959,7 +957,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27179-1" />
<oval id="audit_rules_dac_modification_fremovexattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_fsetxattr">
@@ -987,7 +985,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27180-9" />
<oval id="audit_rules_dac_modification_fsetxattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_lchown">
@@ -1015,7 +1013,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27181-7" />
<oval id="audit_rules_dac_modification_lchown" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_lremovexattr">
@@ -1043,7 +1041,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27182-5" />
<oval id="audit_rules_dac_modification_lremovexattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_lsetxattr">
@@ -1071,7 +1069,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27183-3" />
<oval id="audit_rules_dac_modification_lsetxattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_removexattr">
@@ -1099,7 +1097,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27184-1" />
<oval id="audit_rules_dac_modification_removexattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_rules_dac_modification_setxattr">
@@ -1127,7 +1125,7 @@ calls with others as identifying earlier in this guide is more efficient.
</warning>
<ident cce="27185-8" />
<oval id="audit_rules_dac_modification_setxattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
</Group> <!-- <Group id="audit_dac_actions"> -->
@@ -1144,7 +1142,7 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi
as an attacker attempting to remove evidence of an intrusion.</rationale>
<ident cce="26691-6" />
<oval id="audit_rules_login_events" />
-<ref nist="AC-17(7)" />
+<ref nist="AC-17(7),AU-1(b)" />
</Rule>
<Rule id="audit_manual_session_edits">
@@ -1161,7 +1159,7 @@ storing such process information, add the following to
as an attacker attempting to remove evidence of an intrusion.</rationale>
<ident cce="26610-6" />
<oval id="audit_rules_session_events" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
</Rule>
<Rule id="audit_file_access">
@@ -1184,7 +1182,7 @@ To verify that the audit system collects unauthorized file accesses, run the fol
these events could serve as evidence of potential system compromise.</rationale>
<ident cce="26712-0" />
<oval id="audit_rules_unsuccessful_file_modification" />
-<ref nist="AC-17(7),AU-2" disa="126" />
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126" />
</Rule>
<Rule id="audit_privileged_commands">
@@ -1212,7 +1210,7 @@ unusual activity.
</rationale>
<ident cce="26457-2" />
<oval id="audit_rules_privileged_commands" />
-<ref nist="AC-17(7),AU-2" disa="40" />
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="40" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -1234,7 +1232,7 @@ trail should be created each time a filesystem is mounted to help identify and g
loss.</rationale>
<ident cce="26573-6" />
<oval id="audit_rules_media_export" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
<tested by="DS" on="20121024"/>
</Rule>
@@ -1258,7 +1256,7 @@ from the system. The audit trail could aid in system troubleshooting, as well as
malicious processes that attempt to delete log files to conceal their presence.</rationale>
<ident cce="26651-0" />
<oval id="audit_rules_file_deletion_events" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_sysadmin_actions">
@@ -1276,7 +1274,7 @@ To verify that auditing is configured for system administrator actions, run the
of what was executed on the system, as well as, for accountability purposes.</rationale>
<ident cce="26662-7" />
<oval id="audit_rules_sysadmin_actions" />
-<ref nist="AC-2(7)(b),AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-2(7)(b),AC-17(7),AU-1(b),AU-2" disa="126"/>
<tested by="DS" on="20121024"/>
</Rule>
@@ -1298,7 +1296,7 @@ the kernel and potentially introduce malicious code into kernel space. It is imp
to have an audit trail of modules that have been introduced into the kernel.</rationale>
<ident cce="26611-4" />
<oval id="audit_rules_kernel_module_loading" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
</Rule>
<Rule id="audit_config_immutable">
@@ -1314,7 +1312,7 @@ problematic if legitimate changes are needed during system
operation</rationale>
<ident cce="26612-2" />
<oval id="audit_rules_immutable" />
-<ref nist="AC-6,AU-2" />
+<ref nist="AC-6,AU-1(b),AU-2" />
</Rule>
</Group>
--
1.7.1
More information about the scap-security-guide
mailing list