Bug 1650670
| Summary: | Allow space left in auditd.conf to be expressed as a percentage | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Randall Wood <rwood> |
| Component: | audit | Assignee: | Steve Grubb <sgrubb> |
| Status: | CLOSED ERRATA | QA Contact: | Ondrej Moriš <omoris> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.5 | CC: | omoris, pvrabec, rwood |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | audit-2.8.5-1.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 13:03:45 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Randall Wood
2018-11-16 19:33:40 UTC
This control is part of the NIST 800-53 rev4: https://nvd.nist.gov/800-53/Rev4/control/AU-5 RESPONSE TO AUDIT PROCESSING FAILURES | AUDIT STORAGE CAPACITY The information system provides a warning to [Assignment: organization-defined personnel, roles, and/or locations] within [Assignment: organization-defined time period] when allocated audit record storage volume reaches [Assignment: organization-defined percentage] of repository maximum audit record storage capacity. Auditd meets that. What is being asked for is not a requirement specified by the NIST risk management framework nor specified in Common Criteria. Which leads to a question of does any platform support something like this? How is this met on Windows for example? Thanks. The requirement being asked for is in the document "Committee on National Security Systems Instruction (CNSSI) 1253 Appendix 3: Cross Domain Solution (CDS) Overlays". CNSSI 1253 is at https://www.cnss.gov/CNSS/issuances/Instructions.cfm (the design of that site is such that individual documents cannot be linked against). To my knowledge, the Windows operating system is not considered secure enough to be allowed to be used as a CDS by the US Government, so this requirement would not be levied against that OS. Also to my knowledge, the only OS in active development that is used as a CDS by the US Government is derived from Red Hat Enterprise Linux (Solaris with Trusted Extensions has also been used, but every CDS I am aware of is migrating off that to Red Hat Enterprise Linux). OK. Fair enough. My first thoughts are that this is a general problem (disk capacity) and not specifically an audit problem. I'll dig into this a bit more. Ok. I have done a little research on this. On the Microsoft side, it looks like this kind of alerting is done by their performance monitoring tools. On RHEL, the equivalent is the Performance Co-Pilot. Some basic RHEL documentation that describes it is here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/performance_tuning_guide/s-analyzeperf-pcp Better upstream documentation is here: https://pcp.io/documentation.html In particular, there is the pmie service. https://pcp.io/man/man1/pmie.1.html and example rules such as this: https://github.com/performancecopilot/pcp/blob/master/src/pmie/examples/disk.20 which shows how to do alerts on disk fullness. This is a general solution for any disk capacity problems. You may also find its ability to alert on other problems useful. Thank you for the guidance regarding how to configure PCP for this. Can we at least consider allowing a percentage for the "space_left" and "admin_space_left" in auditd.conf since the NIST guidance is "organization-defined percentage"? Yes, I think it wouldn't be too hard scan the string for % and if found then do the math and place that into the parameter instead. I'll see if I can add this to the upcoming 2.8.5 release. Changing the name of this report to better reflect what the ask is. This feature was added to upstream git repo as commit 58005af. audit-2.8.5-1.el7 was built to address this issue. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2191 |