Merge "Set space_left_action in auditd [+Docs]"
This commit is contained in:
commit
ba8d9bb7ca
|
@ -400,6 +400,10 @@ security_rhel7_auditd_disk_full_action: syslog # RHEL-07-030340
|
|||
security_rhel7_auditd_network_failure_action: syslog # RHEL-07-030340
|
||||
# Size of remaining disk space (in MB) that triggers alerts.
|
||||
security_rhel7_auditd_space_left: "{{ (ansible_mounts | selectattr('mount', 'equalto', '/') | map(attribute='size_total') | first * 0.25 / 1024 / 1024) | int }}" # RHEL-07-030350
|
||||
# Action to take when the space_left threshold is reached.
|
||||
security_rhel7_auditd_space_left_action: email # RHEL-07-030351
|
||||
# Send auditd email alerts to this user.
|
||||
security_rhel7_auditd_action_mail_acct: root # RHEL-07-030352
|
||||
# Add audit rules for commands/syscalls.
|
||||
security_rhel7_audit_chsh: yes # RHEL-07-030525
|
||||
security_rhel7_audit_chage: yes # RHEL-07-030513
|
||||
|
|
|
@ -1,7 +1,16 @@
|
|||
---
|
||||
id: RHEL-07-030351
|
||||
status: not implemented
|
||||
tag: misc
|
||||
status: implemented
|
||||
tag: auditd
|
||||
---
|
||||
|
||||
This STIG requirement is not yet implemented.
|
||||
The ``space_left_action`` in the audit daemon configuration is set to
|
||||
``email``. This configuration causes the root user to receive an email when the
|
||||
``space_left`` threshold is reached.
|
||||
|
||||
Deployers can customize this configuration by setting the following Ansible
|
||||
variable:
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
security_rhel7_auditd_space_left_action: email
|
||||
|
|
|
@ -31,7 +31,9 @@ auditd_config:
|
|||
- parameter: space_left
|
||||
value: "{{ security_rhel7_auditd_space_left }}"
|
||||
config: /etc/audit/auditd.conf
|
||||
|
||||
- parameter: space_left_action
|
||||
value: "{{ security_rhel7_auditd_space_left_action }}"
|
||||
config: /etc/audit/auditd.conf
|
||||
|
||||
## auditd rules
|
||||
# This variable is used in tasks/rhel7stig/auditd.yml to deploy auditd rules
|
||||
|
|
Loading…
Reference in New Issue