Re: New to audit. Need help configuring audit to meet NISPOM req's

[Steve Grubb <sgrubb@redhat.com>]

On Tuesday 27 February 2007 03:25:18 Fields, Randy (Space Technology) wrote:
> Here are the list of items that I need to accomplish and I greatly
> appreciate any help that you can provide. 1) I need to configure a test box
> to meet NISPOM audit requirements. (any examples of /etc/auditd.conf and
> /etc/audit.rules would be great) 2) Then test it by acting as a user and
> trying to access files such as /etc/passwd and /etc/shadow. 3) Then report
> that data to prove to auditors that the tool is collecting the events.

I'd like to include a generic NISPOM configuration in the next set of audit 
packages. Can anyone share some of their contents? I could take a guess at 
it, but would rather have something that has gone through review. I am not 
wanting your site sensitive file locations, but generally this:

1) any syscall auditing you turned on
2) any files you needed to audit in /etc that are not site sensitive
3) any files in /var that needed to audit.

I think all other pieces of the audit system are embedded in the appropriate 
utilities so audit message generation is automatic. The report tool created 
to meet NISPOM is aureport.

Send it to me privately if you do not want your email address public. I would 
appreciate the help...and so would other people in the linux-audit community.

Thanks,
-Steve