<div dir="ltr">Yeah, I know.<div><br></div><div>But I like to change my audit rules when I add new services/items that need to be audited.</div><div><br></div><div>Anywhere that&#39;s actually paying you money to keep their servers up isn&#39;t going to be thrilled with you rebooting them....ever.</div>
<div><br></div><div>If you&#39;re actually auditing your audit rules and offloading your logs, you&#39;ll see someone changing them and thus can react to the change.</div><div><br></div><div>-e 2 makes your system *less* secure in many SLA settings (since you can&#39;t actually audit as much as you should be given system changes) and should be in the realm of &#39;ideal&#39;.</div>
<div><br></div><div>Trevor</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Oct 5, 2013 at 11:33 PM,  <span dir="ltr">&lt;<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000">
    <div>Trevor,<br>
      <br>
      The -e 2 setting ensures that the audit rules are immutable until
      the next reboot.  It ensures the configuration can&#39;t be changed by
      doing someone doing something nefarious to the system.<br>
      <br>
      Regards,<br>
      <br>
      Frank<div><div class="h5"><br>
      <br>
      <br>
      On 10/05/2013 09:27 PM, Trevor Vaughan wrote:<br>
    </div></div></div><div><div class="h5">
    <blockquote type="cite">
      <div dir="ltr">Personally, I&#39;m massively opposed to &#39;-e 2&#39;.
        <div><br>
        </div>
        <div>I really like the ability to audit new things as I add them
          without rebooting my systems.</div>
        <div><br>
        </div>
        <div>Trevor</div>
      </div>
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote">On Fri, Oct 4, 2013 at 8:06 AM, Josh
          Kayse <span dir="ltr">&lt;<a href="mailto:Joshua.Kayse@gtri.gatech.edu" target="_blank">Joshua.Kayse@gtri.gatech.edu</a>&gt;</span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div>On 10/04/2013 07:40 AM, Trevor Vaughan
              wrote:<br>
            </div>
            <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
              <div>
                Is Augeas an option?<br>
                <br>
                This seems like the perfect opportunity to solidify the
                Augeas lenses<br>
                regarding security settings while making life easier for
                everyone.<br>
                <br>
                Trevor<br>
                <br>
                <br>
                On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells &lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a><br>
              </div>
              &lt;mailto:<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;&gt;
              wrote:<br>
              <br>
                  On 10/3/13 3:11 PM, <a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>
              &lt;mailto:<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>&gt;<br>
                  wrote:<br>
              <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                <div>
                      All,<br>
                  <br>
                      As a starting point for writing remediation fixes
                  in the SSG - so,<br>
                      I did the following:<br>
                  <br>
                </div>
                        $ ls ~//scap-security-guide/RHEL6/input/checks//*.xml
                | awk &#39;{
                <div><br>
                      print $1 }&#39; | sed s/\.[^\.]*$// &gt; ~/checks<br>
                </div>
                        $ ls ~//scap-security-guide/RHEL6/input/fixes//*.sh
                | awk &#39;{
                <div><br>
                      print $1 }&#39; | sed s/\.[^\.]*$// &gt; ~/fixes<br>
                          $ sdiff ~/fixes ~/checks | less<br>
                  <br>
                      There&#39;s fair a bit of work to be done for the fix
                  remediations...<br>
                  <br>
                      Since I&#39;m new to the project, I was wondering if
                  there was any<br>
                      ideas or standards to how the SSG should
                  distribute some of these<br>
                      fixes - for example - a wholesale replacement of
                  the audit.rules<br>
                      and auditd.conf might be preferable than doing
                  piecemeal sed&#39;s.<br>
                </div>
              </blockquote>
              <div>
                <br>
                    It&#39;d be omgz easier to `cp
                /usr/share/doc/audit-*/stig.rules<br>
                    /etc/audit.rules`, and that likely is the right
                choice during an<br>
                    initial provisioning process. But then SysAdmins
                tailor audit rules,<br>
                    the system evolves, and we need to evaluate the
                audit.rules file<br>
                    against specific auditing guidance items after the
                pristine<br>
                    audit.rules template is manipulated.<br>
                <br>
                    So, if a single rule must be remediated, we can&#39;t
                blow away the<br>
                    whole audit.rules file. Super fun sed scripts it is
                =/<br>
                <br>
              </div>
              &lt;snip&gt;<br>
            </blockquote>
            <br>
            I think that augeas is a good idea.  We need to be careful
            that rules that are inserted in to audit.rules happen before
            any &#39;-e 2&#39; line (if one exists).  Otherwise they will fail
            to be inserted because the audit rules become locked.<span><font color="#888888"><br>
                <br>
                -josh<br>
                <br>
                -- <br>
                <a href="tel:404.407.6630" value="+14044076630" target="_blank">404.407.6630</a><br>
                <br>
              </font></span><br>
            _______________________________________________<br>
            scap-security-guide mailing list<br>
            <a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
            <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
            <br>
          </blockquote>
        </div>
        <br>
        <br clear="all">
        <div><br>
        </div>
        -- <br>
        Trevor Vaughan<br>
        Vice President, Onyx Point, Inc<br>
        <a href="tel:%28410%29%20541-6699" value="+14105416699" target="_blank">(410) 541-6699</a><br>
        <a href="mailto:tvaughan@onyxpoint.com" target="_blank">tvaughan@onyxpoint.com</a><br>
        <br>
        -- This account not approved for unencrypted proprietary
        information --
      </div>
      <br>
      <fieldset></fieldset>
      <br>
      <pre>_______________________________________________
scap-security-guide mailing list
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
    </blockquote>
    <br>
    <br>
    </div></div><span class="HOEnZb"><font color="#888888"><pre cols="72">-- 
Frank Caviggia
Consultant, Public Sector
<a href="mailto:fcaviggi@redhat.com" target="_blank">fcaviggi@redhat.com</a>
(M) <a href="tel:%28571%29%20295-4560" value="+15712954560" target="_blank">(571) 295-4560</a></pre>
  </font></span></div>

<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</div>