MEDIUM RHCOS (Node) M7: Audit Rules - Login Monitoring P2

Verified Compare Branch Scanned: 2026-01-14

Verified on cnfdt16 OCP 4.22 RHCOS 9.8. Audit rules deployed and compiled into audit.rules.

Overview

This remediation configures audit rules to monitor login events and authentication-related file modifications.

Settings

Rule	Description
`faillock`	Monitor failed login attempts
`lastlog`	Monitor last login records
`tallylog`	Monitor login attempt tallies
`sudoers`	Monitor sudo configuration changes
`usergroup`	Monitor /etc/passwd, /etc/group, /etc/shadow changes

Implementation

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 75-audit-auth-medium
  labels:
    machineconfiguration.openshift.io/role: master
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
        - path: /etc/audit/rules.d/75-login-events.rules
          mode: 0644
          overwrite: true
          contents:
            inline: |
              ## Login and authentication monitoring
              -w /var/log/faillock -p wa -k logins
              -w /var/log/lastlog -p wa -k logins
              -w /var/log/tallylog -p wa -k logins

              ## Sudo configuration
              -w /etc/sudoers -p wa -k actions
              -w /etc/sudoers.d/ -p wa -k actions

              ## User/group modification
              -w /etc/passwd -p wa -k identity
              -w /etc/group -p wa -k identity
              -w /etc/shadow -p wa -k identity
              -w /etc/gshadow -p wa -k identity

Compliance Checks Remediated

Check	Profile	Docs
`rhcos4-e8-worker-audit-rules-login-events-faillock`	E8	📖
`rhcos4-e8-worker-audit-rules-login-events-lastlog`	E8	📖
`rhcos4-e8-worker-audit-rules-login-events-tallylog`	E8	📖
`rhcos4-e8-worker-audit-rules-sysadmin-actions`	E8	📖
`rhcos4-e8-worker-audit-rules-usergroup-modification`	E8	📖

Source Remediation Files (5)

medium/rhcos4-e8-worker-audit-rules-login-events-faillock.yaml
medium/rhcos4-e8-worker-audit-rules-login-events-lastlog.yaml
medium/rhcos4-e8-worker-audit-rules-login-events-tallylog.yaml
medium/rhcos4-e8-worker-audit-rules-sysadmin-actions.yaml
medium/rhcos4-e8-worker-audit-rules-usergroup-modification.yaml

Security Impact

Brute force authentication attempts
Unauthorized user account modifications
Privilege escalation via sudo changes
Account enumeration attacks

Upstream Proposal

The following changes could eliminate the need for MachineConfig remediation. Items are categorized by recommended scope:

Login/authentication audit rules RAN Low

openshift/os /etc/audit/rules.d/50-login-events.rules

Tracks failed logins, sudo usage, and user/group modifications. Core authentication audit trail.
Scope: Login auditing is standard for compliance but may be excessive for dev/test clusters.

PR History

Login/authentication audit rules Not Filed blocked

coreos/rhel-coreos-config

Audit rules are compliance monitoring policies, not security defaults. RHCOS ships no audit rules in rules.d by default — only samples in /usr/share/audit/sample-rules/ that Red Hat explicitly warns are 'not exhaustive nor up to date.' CoreOS maintainers debated whether to include the audit RPM at all (fedora-coreos-tracker#461) and called it 'an odd fit' (coreos/bugs#140). Audit messages already flood console on fresh boot (fedora-coreos-tracker#220). Deploying rules in the base image would substantially increase audit volume for all RHCOS deployments. The Compliance Operator's MachineConfig remediation model is the intended deployment path.

coreos/fedora-coreos-tracker/issues/461 coreos/fedora-coreos-tracker/issues/220 coreos/bugs/issues/140 docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/auditing-the-system_security-hardening

← M6 All Groups M8 →