1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
resource_registry:
OS::TripleO::Services::AuditD: ../puppet/services/auditd.yaml
parameter_defaults:
AuditdRules:
'Record attempts to alter time through adjtimex':
content: '-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules'
order : 1
'Record attempts to alter time through settimeofday':
content: '-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules'
order : 2
'Record Attempts to Alter Time Through stime':
content: '-a always,exit -F arch=b64 -S stime -k audit_time_rules'
order : 3
'Record Attempts to Alter Time Through clock_settime':
content: '-a always,exit -F arch=b64 -S clock_settime -k audit_time_rules'
order : 4
'Record Attempts to Alter the localtime File':
content: '-w /etc/localtime -p wa -k audit_time_rules'
order : 5
'Record Events that Modify the Systems Discretionary Access Controls - chmod':
content: '-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 5
'Record Events that Modify the Systems Discretionary Access Controls - chown':
content: '-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 6
'Record Events that Modify the Systems Discretionary Access Controls - fchmod':
content: '-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 7
'Record Events that Modify the Systems Discretionary Access Controls - fchmodat':
content: '-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 8
'Record Events that Modify the Systems Discretionary Access Controls - fchown':
content: '-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 9
'Record Events that Modify the Systems Discretionary Access Controls - fchownat':
content: '-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 10
'Record Events that Modify the Systems Discretionary Access Controls - fremovexattr':
content: '-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 11
'Record Events that Modify the Systems Discretionary Access Controls - fsetxattr':
content: '-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 12
'Record Events that Modify the Systems Discretionary Access Controls - lchown':
content: '-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 13
'Record Events that Modify the Systems Discretionary Access Controls - lremovexattr':
content: '-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 14
'Record Events that Modify the Systems Discretionary Access Controls - lsetxattr':
content: '-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 15
'Record Events that Modify the Systems Discretionary Access Controls - removexattr':
content: '-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 16
'Record Events that Modify the Systems Discretionary Access Controls - setxattr':
content: '-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod'
order : 17
'Record Events that Modify User/Group Information - /etc/group':
content: '-w /etc/group -p wa -k audit_rules_usergroup_modification'
order : 18
'Record Events that Modify User/Group Information - /etc/passwd':
content: '-w /etc/passwd -p wa -k audit_rules_usergroup_modification'
order : 19
'Record Events that Modify User/Group Information - /etc/gshadow':
content: '-w /etc/gshadow -p wa -k audit_rules_usergroup_modification'
order : 20
'Record Events that Modify User/Group Information - /etc/shadow':
content: '-w /etc/shadow -p wa -k audit_rules_usergroup_modification'
order : 21
'Record Events that Modify User/Group Information - /etc/opasswd':
content: '-w /etc/opasswd -p wa -k audit_rules_usergroup_modification'
order : 22
'Record Events that Modify the Systems Network Environment - sethostname / setdomainname':
content: '-a always,exit -F arch=b64 -S sethostname -S setdomainname -k audit_rules_networkconfig_modification'
order : 23
'Record Events that Modify the Systems Network Environment - /etc/issue':
content: '-w /etc/issue -p wa -k audit_rules_networkconfig_modification'
order : 24
'Record Events that Modify the Systems Network Environment - /etc/issue.net':
content: '-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification'
order : 25
'Record Events that Modify the Systems Network Environment - /etc/hosts':
content: '-w /etc/hosts -p wa -k audit_rules_networkconfig_modification'
order : 26
'Record Events that Modify the Systems Network Environment - /etc/sysconfig/network':
content: '-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification'
order : 27
'Record Events that Modify the Systems Mandatory Access Controls':
content: '-w /etc/selinux/ -p wa -k MAC-policy'
order : 28
'Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful / EACCES)':
content: '-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access'
order : 29
'Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful / EPERM)':
content: '-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access'
order : 30
'Ensure auditd Collects Information on the Use of Privileged Commands':
content: '-a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged'
order : 31
'Ensure auditd Collects Information on Exporting to Media (successful)':
content: '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k export'
order : 32
'Ensure auditd Collects File Deletion Events by User':
content: '-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete'
order : 33
'Ensure auditd Collects System Administrator Actions':
content: '-w /etc/sudoers -p wa -k actions'
order : 34
'Ensure auditd Collects Information on Kernel Module Loading and Unloading (insmod)':
content: '-w /usr/sbin/insmod -p x -k modules'
order : 35
'Ensure auditd Collects Information on Kernel Module Loading and Unloading (rmmod)':
content: '-w /usr/sbin/rmmod -p x -k modules'
order : 36
'Ensure auditd Collects Information on Kernel Module Loading and Unloading (modprobe)':
content: '-w /usr/sbin/modprobe -p x -k modules'
order : 37
|
