diff --git a/linux_os/guide/auditing/policy_rules/audit_immutable_login_uids/policy/stig/shared.yml b/linux_os/guide/auditing/policy_rules/audit_immutable_login_uids/policy/stig/shared.yml deleted file mode 100644 index bb9d2d5ee1e..00000000000 --- a/linux_os/guide/auditing/policy_rules/audit_immutable_login_uids/policy/stig/shared.yml +++ /dev/null @@ -1,23 +0,0 @@ -srg_requirement: |- - {{{ full_name }}} audit system must protect logon UIDs from unauthorized change. - -vuldiscussion: |- - If modification of login UIDs is not prevented, they can be changed by unprivileged users and make auditing complicated or impossible. - -checktext: |- - Verify the audit system prevents unauthorized changes to logon UIDs with the following command: - - $ sudo grep -i immutable /etc/audit/audit.rules - - --loginuid-immutable - - If the "--loginuid-immutable" option is not returned in the "/etc/audit/audit.rules", or the line is commented out, this is a finding. - -fixtext: |- - Configure {{{ full_name }}} auditing to prevent modification of login UIDs once they are set by adding the following line to /etc/audit/rules.d/audit.rules: - - - --loginuid-immutable - - - The audit daemon must be restarted for the changes to take effect. diff --git a/linux_os/guide/auditing/policy_rules/audit_immutable_login_uids/rule.yml b/linux_os/guide/auditing/policy_rules/audit_immutable_login_uids/rule.yml index fc00b38d325..278c50b0cc9 100644 --- a/linux_os/guide/auditing/policy_rules/audit_immutable_login_uids/rule.yml +++ b/linux_os/guide/auditing/policy_rules/audit_immutable_login_uids/rule.yml @@ -58,17 +58,7 @@ fixtext: |-
--loginuid-immutable
- If the file doesn't exist, it can be copied from /usr/share/audit/sample-rules - using the next command - -
-    cp /usr/share/audit/sample-rules/11-loginuid.rules /etc/audit/rules.d/
-    
- Then, run the following commands: $ sudo chmod o-rwx "/etc/audit/rules.d/11-loginuid.rules" $ sudo augenrules --load - -srg_requirement: |- - {{{ full_name }}} audit system must protect logon UIDs from unauthorized change.