Closed warrenbel closed 1 year ago
Hi,
I looked into the CIS RedHat 8 Benchmark v 2.0.0 and found the following:
4.1.3.12 Ensure login and logout events are collected (Automated) Profile Applicability: • Level 2 - Server • Level 2 - Workstation Description: Monitor login and logout events. The parameters below track changes to files associated with login/logout events. • /var/log/lastlog - maintain records of the last time a user successfully logged in. • /var/run/faillock - directory maintains records of login failures via the pam_faillock module.
It's /var/run/faillock. Is /var/run/faillock missng?
the missing is /var/log/faillock
But right, the CIS RedHat 8 Benchmark v 2.0.0 document shows /var/run/faillock,
The STIG document looks updated to /var/log/. I will look into this. It might be the CIS document is not updated,
Thanks, Warren
I add auditd rules for both, /var/log/faillock and /var/run/faillock. Should not harm. Will be in release 0.8.2.
I ran OpenSCAP with profile CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Server Red Hat Enterprise Linux 8 Benchmark™, v2.0.0, released 2022-02-23.
auditd items missing: -w /var/log/faillock -p wa -k logins