<div dir="ltr">Yeah, I know.<div><br></div><div>But I like to change my audit rules when I add new services/items that need to be audited.</div><div><br></div><div>Anywhere that's actually paying you money to keep their servers up isn't going to be thrilled with you rebooting them....ever.</div>
<div><br></div><div>If you're actually auditing your audit rules and offloading your logs, you'll see someone changing them and thus can react to the change.</div><div><br></div><div>-e 2 makes your system *less* secure in many SLA settings (since you can't actually audit as much as you should be given system changes) and should be in the realm of 'ideal'.</div>
<div><br></div><div>Trevor</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Oct 5, 2013 at 11:33 PM, <span dir="ltr"><<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div>Trevor,<br>
<br>
The -e 2 setting ensures that the audit rules are immutable until
the next reboot. It ensures the configuration can't be changed by
doing someone doing something nefarious to the system.<br>
<br>
Regards,<br>
<br>
Frank<div><div class="h5"><br>
<br>
<br>
On 10/05/2013 09:27 PM, Trevor Vaughan wrote:<br>
</div></div></div><div><div class="h5">
<blockquote type="cite">
<div dir="ltr">Personally, I'm massively opposed to '-e 2'.
<div><br>
</div>
<div>I really like the ability to audit new things as I add them
without rebooting my systems.</div>
<div><br>
</div>
<div>Trevor</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Fri, Oct 4, 2013 at 8:06 AM, Josh
Kayse <span dir="ltr"><<a href="mailto:Joshua.Kayse@gtri.gatech.edu" target="_blank">Joshua.Kayse@gtri.gatech.edu</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>On 10/04/2013 07:40 AM, Trevor Vaughan
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
Is Augeas an option?<br>
<br>
This seems like the perfect opportunity to solidify the
Augeas lenses<br>
regarding security settings while making life easier for
everyone.<br>
<br>
Trevor<br>
<br>
<br>
On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells <<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a><br>
</div>
<mailto:<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>>>
wrote:<br>
<br>
On 10/3/13 3:11 PM, <a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>
<mailto:<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>><br>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
All,<br>
<br>
As a starting point for writing remediation fixes
in the SSG - so,<br>
I did the following:<br>
<br>
</div>
$ ls ~//scap-security-guide/RHEL6/input/checks//*.xml
| awk '{
<div><br>
print $1 }' | sed s/\.[^\.]*$// > ~/checks<br>
</div>
$ ls ~//scap-security-guide/RHEL6/input/fixes//*.sh
| awk '{
<div><br>
print $1 }' | sed s/\.[^\.]*$// > ~/fixes<br>
$ sdiff ~/fixes ~/checks | less<br>
<br>
There's fair a bit of work to be done for the fix
remediations...<br>
<br>
Since I'm new to the project, I was wondering if
there was any<br>
ideas or standards to how the SSG should
distribute some of these<br>
fixes - for example - a wholesale replacement of
the audit.rules<br>
and auditd.conf might be preferable than doing
piecemeal sed's.<br>
</div>
</blockquote>
<div>
<br>
It'd be omgz easier to `cp
/usr/share/doc/audit-*/stig.rules<br>
/etc/audit.rules`, and that likely is the right
choice during an<br>
initial provisioning process. But then SysAdmins
tailor audit rules,<br>
the system evolves, and we need to evaluate the
audit.rules file<br>
against specific auditing guidance items after the
pristine<br>
audit.rules template is manipulated.<br>
<br>
So, if a single rule must be remediated, we can't
blow away the<br>
whole audit.rules file. Super fun sed scripts it is
=/<br>
<br>
</div>
<snip><br>
</blockquote>
<br>
I think that augeas is a good idea. We need to be careful
that rules that are inserted in to audit.rules happen before
any '-e 2' line (if one exists). Otherwise they will fail
to be inserted because the audit rules become locked.<span><font color="#888888"><br>
<br>
-josh<br>
<br>
-- <br>
<a href="tel:404.407.6630" value="+14044076630" target="_blank">404.407.6630</a><br>
<br>
</font></span><br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
Trevor Vaughan<br>
Vice President, Onyx Point, Inc<br>
<a href="tel:%28410%29%20541-6699" value="+14105416699" target="_blank">(410) 541-6699</a><br>
<a href="mailto:tvaughan@onyxpoint.com" target="_blank">tvaughan@onyxpoint.com</a><br>
<br>
-- This account not approved for unencrypted proprietary
information --
</div>
<br>
<fieldset></fieldset>
<br>
<pre>_______________________________________________
scap-security-guide mailing list
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
</blockquote>
<br>
<br>
</div></div><span class="HOEnZb"><font color="#888888"><pre cols="72">--
Frank Caviggia
Consultant, Public Sector
<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>
(M) <a href="tel:%28571%29%20295-4560" value="+15712954560" target="_blank">(571) 295-4560</a></pre>
</font></span></div>
<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</div>