Guide to the Secure Configuration of SUSE Linux Enterprise 12
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Ensure auditd Collects Information on the Use of Privileged Commands - reboot
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - shutdown
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Action for auditd to take when log files reach their maximum size
The setting for max_log_file_action in /etc/audit/auditd.conf. The following options are available: <br>ignore - audit daemon does nothing. <br>syslog - audit daemon will issue a warning to syslog....Value -
Action for audispd to take when disk is full
The setting for disk_full_action in /etc/audisp/audisp-remote.confValue -
Ensure auditd Collects Information on the Use of Privileged Commands - chage
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - chfn
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - chsh
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Action for audispd to take when network fails
The setting for network_failure_action in /etc/audisp/audisp-remote.confValue -
Remote server for audispd to send audit records
The setting for remote_server in /etc/audisp/audisp-remote.confValue -
Account for auditd to send email when actions occurs
The setting for action_mail_acct in /etc/audit/auditd.confValue -
Action for auditd to take when disk space is low
The setting for admin_space_left_action in /etc/audit/auditd.confValue -
Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - insmod
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - kmod
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - modprobe
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - newgrp
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - passmass
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program...Rule Medium Severity -
Action for auditd to take when disk errors
'The setting for disk_error_action in /etc/audit/auditd.conf, if multiple values are allowed write them separated by pipes as in "syslog|single|halt", for remediations the first value will be taken'Value -
Action for auditd to take when disk is full
'The setting for disk_full_action in /etc/audit/auditd.conf, if multiple values are allowed write them separated by pipes as in "syslog|single|halt", for remediations the first value will be taken'Value
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.