Include Local Events in Audit Logs
An XCCDF Rule
Description
To configure Audit daemon to include local events in Audit logs, set
local_events to yes in /etc/audit/auditd.conf.
This is the default setting.
Rationale
If option local_events isn't set to yes only events from
network will be aggregated.
- ID
- xccdf_org.ssgproject.content_rule_auditd_local_events
- Severity
- Medium
- References
- Updated
Remediation - Kubernetes Patch
---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
config:
ignition:
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
if [ -e "/etc/audit/auditd.conf" ] ; then
LC_ALL=C sed -i "/^\s*local_events\s*=\s*/Id" "/etc/audit/auditd.conf"
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- CCE-83682-5
- DISA-STIG-RHEL-09-653075