tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-28 16:14:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of https://github.com/hardenedlinux/harbian-audit

Browse Source
This commit is contained in:
Samson-W 2018-11-29 22:31:12 -05:00
commit 200d337df5
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/examples/configurations/etc.audit.rules.d.audit.rules
View File

@ -90,3 +90,6 @@
-w /etc/profile -p wa -k config_file_change -w /etc/profile -p wa -k config_file_change
-w /etc/profile.d/ -p wa -k config_file_change -w /etc/profile.d/ -p wa -k config_file_change
-w /etc/security/ -p wa -k config_file_change -w /etc/security/ -p wa -k config_file_change
-w /etc/iptables/ -p wa -k config_file_change
-w /etc/sysctl.conf -p wa -k config_file_change

2
docs/harbian_audit_Debian_9_Benchmark_v0.1.mkd
View File

@ -837,6 +837,7 @@ Verify the operating system generates audit records that modify configuration. C
-w /etc/profile -p wa -k config_file_change -w /etc/profile -p wa -k config_file_change
-w /etc/profile.d/ -p wa -k config_file_change -w /etc/profile.d/ -p wa -k config_file_change
-w /etc/security/ -p wa -k config_file_change -w /etc/security/ -p wa -k config_file_change
-w /etc/iptables/ -p wa -k config_file_change
-w /etc/sysctl.conf -p wa -k config_file_change -w /etc/sysctl.conf -p wa -k config_file_change
``` ```
If the command does not return any output, this is a finding. If the command does not return any output, this is a finding.
@ -855,6 +856,7 @@ Fixtext: Configure the operating system to generate audit records that modify co
-w /etc/profile -p wa -k config_file_change -w /etc/profile -p wa -k config_file_change
-w /etc/profile.d/ -p wa -k config_file_change -w /etc/profile.d/ -p wa -k config_file_change
-w /etc/security/ -p wa -k config_file_change -w /etc/security/ -p wa -k config_file_change
-w /etc/iptables/ -p wa -k config_file_change
-w /etc/sysctl.conf -p wa -k config_file_change -w /etc/sysctl.conf -p wa -k config_file_change
``` ```
The audit daemon must be restarted for the changes to take effect. The audit daemon must be restarted for the changes to take effect.