Changeset 217

Show
Ignore:
Timestamp:
07/24/08 08:49:56 (4 months ago)
Author:
slawrence
Message:

Specify audit dispatcher in auditd.conf
Use different audit rules for 32-bit and 64-bit archs
Copy system-auth changes in kickstart to stigs and conf file
Fix installation of audit rules

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/RHEL5.2/RPM/clip.spec

    r198 r217  
    3737%defattr(-,root,root,-) 
    3838/usr/share/clip/conf/audit/auditd.conf 
    39 #/usr/share/clip/conf/audit/audit.rules 
     39/usr/share/clip/conf/audit/audit-i386.rules 
     40/usr/share/clip/conf/audit/audit-x86_64.rules 
    4041/usr/share/clip/conf/pam/login.pam 
    4142/usr/share/clip/conf/pam/newrole.pam 

  • trunk/RHEL5.2/conf/audit/Makefile

    r198 r217  
    11install: 
    22        test -d $(DESTDIR)$(CONFDIR)/audit | install -d -m 755 $(DESTDIR)$(CONFDIR)/audit  
    3 #       install -m 644 *.conf *.rules $(DESTDIR)$(CONFDIR)/audit 
    4         install -m 644 *.conf $(DESTDIR)$(CONFDIR)/audit 
     3        install -m 644 *.conf *.rules $(DESTDIR)$(CONFDIR)/audit 

  • trunk/RHEL5.2/conf/audit/auditd.conf

    r1 r217  
    99freq = 20 
    1010num_logs = 4 
    11 #dispatcher = /root/src/skeleton 
     11dispatcher = /sbin/audispd 
    1212max_log_file = 5  
    1313max_log_file_action = ROTATE 

  • trunk/RHEL5.2/conf/pam/system-auth.pam

    r201 r217  
    1414account     required      pam_permit.so 
    1515 
    16 password    required      pam_cracklib.so try_first_pass retry=3 minlen=14 difok=4 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 
     16password    required      pam_passwdqc.so min=disabled,disabled,disabled,disabled,14 max=40 passphrase=0 match=0 similar=deny random=0 enforce=everyone retry=3 
    1717password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=12 
    1818password    required      pam_deny.so 

  • trunk/RHEL5.2/kickstart/clip.ks

    r212 r217  
    666666EOF 
    667667 
     668cat <<-EOF > /etc/audit/auditd.conf 
     669        log_file = /var/log/audit/audit.log 
     670        log_format = RAW 
     671        priority_boost = 3 
     672        flush = INCREMENTAL 
     673        freq = 20 
     674        num_logs = 4 
     675        dispatcher = /sbin/audispd 
     676        max_log_file = 5  
     677        max_log_file_action = ROTATE 
     678        space_left = 75 
     679        space_left_action = SYSLOG 
     680        action_mail_acct = root 
     681        admin_space_left = 50 
     682        admin_space_left_action = HALT 
     683        disk_full_action = HALT 
     684        disk_error_action = HALT 
     685EOF 
     686 
    668687## (GEN002680: CAT II) (Previously – G094) The SA will ensure audit data files 
    669688## and directories will be readable only by personnel authorized by the IAO. 
    …… 
    746765cat <<-EOF >> /etc/audit/audit.rules 
    747766        # system administration actions 
    748         # these two lines could be the cause of problems with filling audit logs and preventing system usage after installation 
    749767        -w /var/log/audit/audit.log 
    750768        -w /var/log/audit/audit[1-4].log 

  • trunk/RHEL5.2/scripts/installer.in

    r198 r217  
    3939InstallAudit() { 
    4040    Copy $AUDITDIR/auditd.conf /etc/audit/auditd.conf 
    41 #    Copy $AUDITDIR/audit.rules /etc/audit/audit.rules 
     41    if [ "$(uname -i)" == "x86_64" ] 
     42    then 
     43        Copy $AUDITDIR/audit-x86_64.rules /etc/audit/audit.rules 
     44    else 
     45        Copy $AUDITDIR/audit-i386.rules /etc/audit/audit.rules 
     46    fi 
     47 
    4248    auditctl -R /etc/audit/audit.rules 
    4349} 
    …… 
    5359        for f in $MANDIR/*.8; do 
    5460                Copy $f /usr/share/man/man8/$(basename $f) 
    55         done 
    56 } 
    57  
    58 # Install a collection of scripts to make CLIP  
    59 # STIG-compliant.  
    60 # Since these scripts are not likely to be found on the system, 
    61 # cp and not Copy() is used to install these files.  
    62 InstallStig() { 
    63         for d in $(ls -R $STIGFIXDIR); do 
    64                 cp -r $d /usr/share/clip/scripts/stig-fix &2>/dev/null 
    6561        done 
    6662} 
    …… 
    9288InstallPam 
    9389InstallMan 
    94 InstallStig 
    9590#RunStigFixes 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen000460.sh

    r201 r217  
    2424account     required      pam_permit.so 
    2525 
    26 password    required      pam_cracklib.so try_first_pass retry=3 minlen=14 difok=4 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 
     26password    required      pam_passwdqc.so min=disabled,disabled,disabled,disabled,14 max=40 passphrase=0 match=0 similar=deny random=0 enforce=everyone retry=3 
    2727password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=12 
    2828password    required      pam_deny.so 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen002660.sh

    r192 r217  
    2222EOF 
    2323 
     24cat <<-EOF > /etc/audit/auditd.conf 
     25        log_file = /var/log/audit/audit.log 
     26        log_format = RAW 
     27        priority_boost = 3 
     28        flush = INCREMENTAL 
     29        freq = 20 
     30        num_logs = 4 
     31        dispatcher = /sbin/audispd 
     32        max_log_file = 5  
     33        max_log_file_action = ROTATE 
     34        space_left = 75 
     35        space_left_action = SYSLOG 
     36        action_mail_acct = root 
     37        admin_space_left = 50 
     38        admin_space_left_action = HALT 
     39        disk_full_action = HALT 
     40        disk_error_action = HALT 
     41EOF 
     42 

  • trunk/RHEL5.2/scripts/stig-fix/cat2/gen002820.sh

    r197 r217  
    88cat <<-EOF >> /etc/audit/audit.rules 
    99    # system administration actions 
    10     # these two lines could be the cause of problems with filling audit logs and preventing system usage after installation 
    1110    -w /var/log/audit/audit.log 
    1211    -w /var/log/audit/audit[1-4].log