[PATCH 02/20] Mapped AU-1(b)

Shawn Wells shawn.d.wells at gmail.com
Sat Jan 12 18:18:23 UTC 2013


-------------- next part --------------
>From 41a5457372c218ac5c6c93033086ff10e2c96a7f Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 10 Jan 2013 07:09:01 -0500
Subject: [PATCH 02/20] Mapped AU-1(b)
 AU-1(b) calls for "... procedures to facilitate the implimentation of the audit and accountability policy....,"
 thus maps to all the rules within our all audit section

---
 RHEL6/input/profiles/nist-CL-IL-AL.xml |   12 +++++
 RHEL6/input/system/auditing.xml        |   84 +++++++++++++++----------------
 2 files changed, 53 insertions(+), 43 deletions(-)

diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 49375ce..5e22314 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -249,6 +249,18 @@ assurance."</description>
 <select idref="service_autofs_disabled" selected="true" \>
 <select idref="gconf_gnome_disable_automount" selected="true" \>
 
+<!-- AU-1(b) -->
+<select idref="configure_auditd_num_logs" selected="true" \>
+<select idref="configure_auditd_max_log_file" selected="true" \>
+<select idref="configure_auditd_max_log_file_action" selected="true" \>
+<select idref="configure_auditd_space_left_action" selected="true" \>
+<select idref="configure_auditd_admin_space_left_action" selected="true" \>
+<select idref="configure_auditd_action_mail_acct" selected="true" \>
+<select idref="configure_auditd_audispd" selected="true" \>
+
+
+
+
 <!-- REMAINING MAPPINGS
      AU-1
      AU-2
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 4a09e60..a05a2b7 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -93,7 +93,7 @@ actions will be taken if other obstacles exist.
 </rationale>
 <ident cce="27058-7" />
 <oval id="service_auditd_enabled" />
-<ref nist="AC-17(1),AU-1, CM-6" disa="347,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
+<ref nist="AC-17(1),AU-1(b), CM-6" disa="347,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -118,7 +118,7 @@ process during boot.
 </rationale>
 <ident cce="26785-6" />
 <oval id="bootloader_audit_argument" />
-<ref nist="AC-17(1),AU-2" disa="1464,130" />
+<ref nist="AC-17(1),AU-1(b),AU-2" disa="1464,130" />
 </Rule>
 
 <Group id="configure_auditd_data_retention">
@@ -246,11 +246,10 @@ determine how many logs the system is configured to retain after rotation:
 log information over the period required. This is a function of the maximum log
 file size and the number of logs retained.</rationale>
 <oval id="auditd_data_retention_num_logs" value="var_auditd_num_logs" /> 
-<ref nist="AU-11, CM-6" />
+<ref nist="AU-1(b),AU-11,CM-6" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="configure_auditd_max_log_file" severity="medium">
 <title>Configure auditd Max Log File Size</title>
 <description>Determine the amount of audit data (in megabytes)
@@ -271,11 +270,10 @@ determine how much data the system will retain in each audit log file:
 log information over the period required. This is a function of the maximum
 log file size and the number of logs retained.</rationale>
 <oval id="auditd_data_retention_max_log_file" value="var_auditd_max_log_file" /> 
-<ref nist="AU-11, CM-6" />
+<ref nist="AU-1(b),AU-11,CM-6" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="configure_auditd_max_log_file_action" severity="medium">
 <title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title>
 <description> The default action to take when the logs reach their maximum size
@@ -307,7 +305,7 @@ being overwhelmed with log data. However, for systems that must never discard
 log data, or which use external processes to transfer it and reclaim space,
 <tt>keep_logs</tt> can be employed.</rationale>
 <oval id="auditd_data_retention_max_log_file_action" value="var_auditd_max_log_file_action" />
-<ref nist="AU-4, AU-11, CM-6" />
+<ref nist="AU-1(b),AU-4,AU-11,CM-6" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -357,7 +355,7 @@ disk space is starting to run low:
 <rationale>Notifying administrators of an impending disk space problem may
 allow them to take corrective action prior to any disruption.</rationale>
 <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
-<ref nist="AU-4, CM-6" disa="140,143,1339" />
+<ref nist="AU-1(b),AU-4,CM-6" disa="140,143,1339" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -397,7 +395,7 @@ audit records. If a separate partition or logical volume of adequate size
 is used, running low on space for audit records should never occur.
 </rationale>
 <oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
-<ref nist="AU-4, CM-6" disa="140,1343" />
+<ref nist="AU-1(b),AU-4,CM-6" disa="140,1343" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -419,7 +417,7 @@ account when it needs to notify an administrator:
 <rationale>Email sent to the root account is typically aliased to the
 administrators of the system, who can take appropriate action.</rationale>
 <oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
-<ref nist="AU-4, CM-6" disa="139,144" />
+<ref nist="AU-1(b),AU-4,CM-6" disa="139,144" />
 </Rule>
 
 <Rule id="configure_auditd_audispd" severity="medium">
@@ -439,7 +437,7 @@ If the plugin is active, the output will show <tt>yes</tt>.
 records to a centralized server for management directly.  It does, however, 
 include an audit event multiplexor plugin (audispd) to pass audit records 
 to the local syslog server</rationale>
-<ref nist="AU-3" disa="136" />
+<ref nist="AU-1(b),AU-3" disa="136" />
 </Rule>
 
 </Group>
@@ -514,7 +512,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="26242-8" />
 <oval id="audit_rules_time_adjtimex" />
-<ref nist="AU-2,AC-17(7)" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -542,7 +540,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27203-9" />
 <oval id="audit_rules_time_settimeofday" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -568,7 +566,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27169-2" />
 <oval id="audit_rules_time_stime" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -596,7 +594,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27170-0" />
 <oval id="audit_rules_time_clock_settime" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -621,7 +619,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27172-6" />
 <oval id="audit_rules_time_watch_localtime" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
 <ref disa="1487,169" />
 </Rule>
 </Group><!--End <Group id="audit_time_rules"> -->
@@ -650,7 +648,7 @@ unexpected users, groups, or modifications should be investigated for
 legitimacy.</rationale>
 <ident cce="26664-3" />
 <oval id="audit_rules_usergroup_modification" />
-<ref nist="AC-2(4),AC-17(7),AU-2" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
+<ref nist="AC-2(4),AC-17(7),AU-1(b),AU-2" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
 </Rule>
 
 <Rule id="audit_network_modifications">
@@ -676,7 +674,7 @@ than administrator action. Any change to network parameters should be
 audited.</rationale>
 <ident cce="26648-6" />
 <oval id="audit_rules_networkconfig_modification" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
 </Rule>
 
 <Rule id="audit_logs_permissions">
@@ -694,7 +692,7 @@ Audit logs must be mode 0640 or less permissive.
 If users can write to audit logs, audit trails can be modified or destroyed.
 </rationale>
 <oval id="file_permissions_var_log_audit" />
-<ref nist="AC-6,AU-9" disa="166" />
+<ref nist="AC-6,AU-1(b),AU-9" disa="166" />
 <tested by="DS" on="20121024"/>
 </Rule> 
 
@@ -709,7 +707,7 @@ If users can write to audit logs, audit trails can be modified or destroyed.
 <rationale>Failure to give ownership of the audit log file(s) to root allows the designated 
 owner, and unauthorized users, potential access to sensitive information.</rationale>
 <oval id="file_ownership_var_log_audit" />
-<ref nist="AC-6,AU-9" disa="166" />
+<ref nist="AC-6,AU-1(b),AU-9" disa="166" />
 <tested by="DS" on="20121024"/>
 </Rule> 
 
@@ -731,7 +729,7 @@ arbitrarily changed by anything other than administrator action. All changes to
 MAC policy should be audited.</rationale>
 <ident cce="26657-7" />
 <oval id="audit_rules_mac_modification" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
 </Rule>
 
 <Group id="audit_dac_actions">
@@ -791,7 +789,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="26280-8" />
 <oval id="audit_rules_dac_modification_chmod" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_chown">
@@ -819,7 +817,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27173-4" />
 <oval id="audit_rules_dac_modification_chown" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchmod">
@@ -847,7 +845,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27174-2" />
 <oval id="audit_rules_dac_modification_fchmod" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchmodat">
@@ -875,7 +873,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27175-9" />
 <oval id="audit_rules_dac_modification_fchmodat" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchown">
@@ -903,7 +901,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27177-5" />
 <oval id="audit_rules_dac_modification_fchown" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchownat">
@@ -931,7 +929,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27178-3" />
 <oval id="audit_rules_dac_modification_fchownat" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fremovexattr">
@@ -959,7 +957,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27179-1" />
 <oval id="audit_rules_dac_modification_fremovexattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fsetxattr">
@@ -987,7 +985,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27180-9" />
 <oval id="audit_rules_dac_modification_fsetxattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_lchown">
@@ -1015,7 +1013,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27181-7" />
 <oval id="audit_rules_dac_modification_lchown" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_lremovexattr">
@@ -1043,7 +1041,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27182-5" />
 <oval id="audit_rules_dac_modification_lremovexattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_lsetxattr">
@@ -1071,7 +1069,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27183-3" />
 <oval id="audit_rules_dac_modification_lsetxattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_removexattr">
@@ -1099,7 +1097,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27184-1" />
 <oval id="audit_rules_dac_modification_removexattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_setxattr">
@@ -1127,7 +1125,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27185-8" />
 <oval id="audit_rules_dac_modification_setxattr" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 </Group> <!-- <Group id="audit_dac_actions"> -->
@@ -1144,7 +1142,7 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi
 as an attacker attempting to remove evidence of an intrusion.</rationale>
 <ident cce="26691-6" />
 <oval id="audit_rules_login_events" />
-<ref nist="AC-17(7)" />
+<ref nist="AC-17(7),AU-1(b)" />
 </Rule>
 
 <Rule id="audit_manual_session_edits">
@@ -1161,7 +1159,7 @@ storing such process information, add the following to
 as an attacker attempting to remove evidence of an intrusion.</rationale>
 <ident cce="26610-6" />
 <oval id="audit_rules_session_events" />
-<ref nist="AC-17(7),AU-2" />
+<ref nist="AC-17(7),AU-1(b),AU-2" />
 </Rule>
 
 <Rule id="audit_file_access">
@@ -1184,7 +1182,7 @@ To verify that the audit system collects unauthorized file accesses, run the fol
 these events could serve as evidence of potential system compromise.</rationale>
 <ident cce="26712-0" />
 <oval id="audit_rules_unsuccessful_file_modification" />
-<ref nist="AC-17(7),AU-2" disa="126" />
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126" />
 </Rule>
 
 <Rule id="audit_privileged_commands">
@@ -1212,7 +1210,7 @@ unusual activity.
 </rationale>
 <ident cce="26457-2" />
 <oval id="audit_rules_privileged_commands" />
-<ref nist="AC-17(7),AU-2" disa="40" />
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="40" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -1234,7 +1232,7 @@ trail should be created each time a filesystem is mounted to help identify and g
 loss.</rationale>
 <ident cce="26573-6" />
 <oval id="audit_rules_media_export" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -1258,7 +1256,7 @@ from the system. The audit trail could aid in system troubleshooting, as well as
 malicious processes that attempt to delete log files to conceal their presence.</rationale>
 <ident cce="26651-0" />
 <oval id="audit_rules_file_deletion_events" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_sysadmin_actions">
@@ -1276,7 +1274,7 @@ To verify that auditing is configured for system administrator actions, run the
 of what was executed on the system, as well as, for accountability purposes.</rationale>
 <ident cce="26662-7" />
 <oval id="audit_rules_sysadmin_actions" />
-<ref nist="AC-2(7)(b),AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-2(7)(b),AC-17(7),AU-1(b),AU-2" disa="126"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -1298,7 +1296,7 @@ the kernel and potentially introduce malicious code into kernel space. It is imp
 to have an audit trail of modules that have been introduced into the kernel.</rationale>
 <ident cce="26611-4" />
 <oval id="audit_rules_kernel_module_loading" />
-<ref nist="AC-17(7),AU-2" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2" disa="126"/>
 </Rule>
 
 <Rule id="audit_config_immutable">
@@ -1314,7 +1312,7 @@ problematic if legitimate changes are needed during system
 operation</rationale>
 <ident cce="26612-2" />
 <oval id="audit_rules_immutable" />
-<ref nist="AC-6,AU-2" />
+<ref nist="AC-6,AU-1(b),AU-2" />
 </Rule>
 </Group>
 
-- 
1.7.1



More information about the scap-security-guide mailing list