Suppress messages from /var/log/audit.log via audit.rules

[Steve Grubb]

On Monday, October 03, 2011 10:36:31 PM Worsham, Michael wrote:
> About the rule that’s 'killing' us (which I totally agree it is), this is
> what the stig.rules project says about it (GEN002720):
> 
> 78    ## (GEN002720-GEN002840: CAT II) (Previously G100-G106) The SA will
> 79    ## configure the auditing system to audit the following events for
> all 80    ## users and root:
> 81    ##
> 82    ## - Logon (unsuccessful and successful) and logout (successful)
> 83    ##
> 84    ## Handled by pam, sshd, login, and gdm
> 
> But here is what the latest version of the Unix checklist says the
> vulnerability is, and how to check if its mitigated:
> 
> Unix Checklist v5r1-30 20110729
> 3.2.1.119
> PDI:  GEN002720   – Audit Failed File and Program Access Attempts
> PDI Description: The audit system is not configured to audit failed
> attempts to access files and programs. Reference: UNIX STIG: 3.16
> -  Linux

I'll have to double check the numbering. Things may have shifted since I wrote the 
stig.rules file.


>    For LAUS:
>    # grep “@open-ops” /etc/audit/filter.conf
> 
>    For auditd:
>    # grep “-a exit,always –S open –F success=0” /etc/audit.rules

This would appear that you are using an old stig.rules file. You might want to update 
it.
 
 
> The two don’t seem to jibe as to what the vulnerability is. I’m not sure
> how login, sshd, etc, can give information about failed attempts to access
> files.

The rules file is listing several requirements which has the rules in-between the 
requirements. The first part is to satisfy the logon/off requirements. Farther down is 
the unsuccessful access requirement.

> As to altering the rule, while I’m sure the results would be much more
> useful and relevant (you can tell DISA’s thinking is out-of-date by the
> mitigation steps above), my only concern is that it would no longer be
> STIG compliant, or something that would always come up as a finding, that
> we would have to explain each time.

I occassionally chat with the DISA FSO people. The intent is the stig.rules file in the 
audit package is compliant. I think they have altered the auditing requirements to 
match what is shipped. But you just need to update to a newer version of the file.

-Steve