Giters

chef-cookbooks / auditd

Install and configure user mode auditd tools

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

CIS 4.1.14 needs to be different for RHEL7 and RHEL6

james-stocks opened this issue · comments

commented

The current CIS rule set in this cookbook includes:

# CIS 4.1.14
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

For RHEL6, the CIS recommendation (see here) has auid>=500

# grep delete /etc/audit/audit.rules
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete