MEDIUM M7: Audit Rules - Login Monitoring P2
Overview
This remediation configures audit rules to monitor login events and authentication-related file modifications.
Settings
| Rule | Description |
|---|---|
faillock |
Monitor failed login attempts |
lastlog |
Monitor last login records |
tallylog |
Monitor login attempt tallies |
sudoers |
Monitor sudo configuration changes |
usergroup |
Monitor /etc/passwd, /etc/group, /etc/shadow changes |
Implementation
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 75-audit-auth-medium
labels:
machineconfiguration.openshift.io/role: master
spec:
config:
ignition:
version: 3.2.0
storage:
files:
- path: /etc/audit/rules.d/75-login-events.rules
mode: 0644
overwrite: true
contents:
inline: |
## Login and authentication monitoring
-w /var/log/faillock -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins
## Sudo configuration
-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions
## User/group modification
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
Compliance Checks Remediated
| Check | Profile | Docs |
|---|---|---|
rhcos4-e8-worker-audit-rules-login-events-faillock |
E8 | 📖 |
rhcos4-e8-worker-audit-rules-login-events-lastlog |
E8 | 📖 |
rhcos4-e8-worker-audit-rules-login-events-tallylog |
E8 | 📖 |
rhcos4-e8-worker-audit-rules-sysadmin-actions |
E8 | 📖 |
rhcos4-e8-worker-audit-rules-usergroup-modification |
E8 | 📖 |
Source Remediation Files (5)
- medium/rhcos4-e8-worker-audit-rules-login-events-faillock.yaml
- medium/rhcos4-e8-worker-audit-rules-login-events-lastlog.yaml
- medium/rhcos4-e8-worker-audit-rules-login-events-tallylog.yaml
- medium/rhcos4-e8-worker-audit-rules-sysadmin-actions.yaml
- medium/rhcos4-e8-worker-audit-rules-usergroup-modification.yaml
Security Impact
Login monitoring helps detect:
- Brute force authentication attempts
- Unauthorized user account modifications
- Privilege escalation via sudo changes
- Account enumeration attacks