-
Notifications
You must be signed in to change notification settings - Fork 0
/
RHEL-06-000005.sh
executable file
·101 lines (84 loc) · 3.33 KB
/
RHEL-06-000005.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
#!/bin/bash
#
##########################################################################
#Red Hat Enterprise Linux 6 - DISA STIG Compliance Remediation Content
#Copyright (C) 2013
#Vincent C. Passaro ([email protected])
#
##########################################################################
#
###################### Buddha Labs LLC ################################
# By Vincent C. Passaro #
# Buddha Labs LLC. #
# vince[@]buddhalabs[.]com #
# www.buddhalabs.com #
###################### Buddha Labs LLC ################################
#_________________________________________________________________________
# Version | Change Information | Author | Date
#-------------------------------------------------------------------------
# 1.0 | Initial Script Creation | Vincent Passaro | 1-JUNE-2013
#
#
#######################DISA INFORMATION##################################
# Group ID (Vulid): RHEL-06-000005
# Group Title: SRG-OS-000045
#
# Rule ID: RHEL-06-000005_rule
# Severity: medium
# Rule Version (STIG-ID): RHEL-06-000005
# Rule Title: The audit system must alert designated staff members when
# the audit storage volume approaches capacity.
#
# Vulnerability Discussion: Notifying administrators of an impending disk
# space problem may allow them to take corrective action prior to any
# disruption.
#
# Responsibility:
# IAControls:
#
# Check Content:
#
# Inspect "/etc/audit/auditd.conf" and locate the following line to
# determine if the system is configured to email the administrator when
# disk space is starting to run low:
# grep space_left_action /etc/audit/auditd.conf
# space_left_action = email
# If the system is not configured to send an email to the system
# administrator when disk space is starting to run low, this is a finding.
#
# Fix Text:
#
# The "auditd" service can be configured to take an action when disk
# space starts to run low. Edit the file "/etc/audit/auditd.conf". Modify
# the following line, substituting [ACTION] appropriately:
# space_left_action = [ACTION]
# Possible values for [ACTION] are described in the "auditd.conf" man page.
# These include:
# "ignore"
# "syslog"
# "email"
# "exec"
# "suspend"
# "single"
# "halt"
# Set this to "email" (instead of the default, which is "suspend") as it is
# more likely to get prompt attention.
# RHEL-06-000521 ensures that the email generated through the operation
# "space_left_action" will be sent to an administrator.
#######################DISA INFORMATION##################################
#
# Global Variables
PDI=RHEL-06-000005
SEVERITY=medium
#
#BEGIN_CHECK
. ./aqueduct_functions
MOD_MSG="auditd space_left_action=SYSLOG"
PKG_CONFIG=/etc/audit/auditd.conf
verify_setting "^space_left_action = SYSLOG" "unused" $PKG_CONFIG $PDI "$MOD_MSG" $SEVERITY
#END_CHECK
#BEGIN_REMEDY
#sed -i 's/^space_left_action = IGNORE/space_left_action = SYSLOG/g' /etc/audit/auditd.conf
#sed -i 's/^space_left_action = SUSPEND/space_left_action = SYSLOG/g' /etc/audit/auditd.conf
edit_file $PKG_CONFIG $PDI 'space_left_action = SYSLOG' 'space_left_action'
#END_REMEDY