<div dir="ltr"><div><div><div>This may be faster and also a better way to summarize and share with others.<br></div><div>I will list the AUDIT(test#letter) and then below it place <b>Method of implementation:</b> and if the field is marked in green, it is validated by someone <br>from <a href="mailto:linux-audit@redhat.com">linux-audit@redhat.com</a> (Steve Grubb for example) and the text provided will answer the question for other sysadmins with similar requirements (on a per test#letter basis).<br><br></div><div><br></div>I am presenting what I need to know how to audit, in hopes to illicit a response of "BUILTIN" or a link or some text that clarifies what to do:<br><br></div><b>AUDIT(A): Logons/Logoffs (success/failure)</b><br></div><span style="color:rgb(0,255,0)">Method of implementation:</span> Builtin to AUDITD (enable auditd)<br><div><div><div><br></div><div><b>AUDIT(B): User {additions, deletions, modifications, suspensions and lockings}</b><br></div><div><span style="color:rgb(0,255,0)">Method of implementation:</span> Builtin to AUDITD (enable auditd)<br><br></div><div><b>AUDIT(C): Group and Role {additions, deletions and modifications}</b><br><span style="color:rgb(0,255,0)">Method of implementation:</span> Builtin to AUDITD (enable auditd)<br><br></div><div><b>AUDITD(D): Security or Audit Policies<br></b></div><div><span style="color:rgb(255,0,0)">Method of implementation:</span><b><br></b></div><div><br></div><div><b>AUDIT(E): Configuration Changes</b> (please be patient with me, as I believe this is way too broad a definition from my security people; however, there is a field from aureport called "<span style="color:rgb(0,0,255)"><i><b>Number of changes in configuration:</b></i></span>" too.<br></div><div><span style="color:rgb(255,0,0)">Method of implementation:</span><br></div><div>can this be done by; <b>-w /etc/ -p raw -k config_changes</b> even this seems too broad a solution and I don't believe it will capture the essence of <b>AUDIT(E).<br><br></b></div><div><b>AUDIT(F): Admin/Root-level accesses<br></b></div><div><div><span style="color:rgb(255,0,0)">Method of implementation:</span><br></div>can this be done by; <b>-w /bin/su -p x -k running_as_root -w /bin/sudo -p x -k running_as_root -w /sbin/runuser -p x -k running_as_root</b> <br><br></div><div><b>AUDIT(G): Privilege/Role Escalation </b>(I need to ask how this differs from AUDIT(F) from my management/security people)<br><span style="color:rgb(255,0,0)">Method of implementation:</span><br></div><div><br></div><div><b>AUDIT(H): System reboot/shutdown/change run-state<br></b><span style="color:rgb(255,0,0)">Method of implementation:</span></div><div>can this be done by; <b>-w /sbin/init -p x -k run_state -w /sbin/telinit -p x -k run_state</b> <b>-w /sbin/shutdown -p x -k run_state -w /sbin/reboot -p x -k run_state etc.. etc.. etc..<br><br></b></div><div><b>AUDIT(I): Application Initialization</b> (seems way to vague to me, don't you all agree?)<br><span style="color:rgb(255,0,0)">Method of implementation:</span><br></div><div><br></div><div><b>AUDIT(J): Writes/Downloads to external devices (thumdrives,media </b>(like DvDs/CD), etc..<b>)<br></b><span style="color:rgb(255,0,0)">Method of implementation:</span></div><div>can this be done by -a .... -F arch=b64 -S mount -S umount2 -F auid>=1000 -F auid!=4294967295 -k mount_datawrite_operations? No, what do I use?<br><br></div><div><b>AUDIT(K): Print to a device or file<br></b><span style="color:rgb(255,0,0)">Method of implementation:</span></div><div><br></div><div><b>AUDIT(L): Audit data and log data access </b>(nevremind, this would kill a system - correct, unless I limit monitoring to audit.log.*)<br></div><div><span style="color:rgb(255,0,0)">Method of implementation:</span><br><br></div><div><b>AUDIT(M): Device attach/detach mount/dismount </b>(Perhaps this would catch 1 or more than 1 individual doing something devious as a team in conjunction with <b>AUDIT(J)</b>?)<br><span style="color:rgb(255,0,0)">Method of implementation:</span><br></div><div><br><br></div><div>Thank you for your vast patience and cooperation.<br clear="all"><div><div><div class="gmail_signature"><div dir="ltr">--------------------------<br><font color="#000099" size="4">Warron French<br><font size="4"><font size="4"><font size="4"><br></font></font></font></font></div></div></div> </div></div></div></div></div>