documentation_complete: true

title: 'Record Events that Modify the System''s Network Environment'

description: |-
    Add the following to <tt>/etc/audit/audit.rules</tt>, setting
    ARCH to either b32 or b64 as appropriate for your system:
    <pre># audit_rules_networkconfig_modification
    -a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_rules_networkconfig_modification
    -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</pre>

rationale: |-
    The network environment should not be modified by anything other
    than administrator action. Any change to network parameters should be
    audited.

severity: unknown

identifiers:
    cce: 26648-6

references:
    nist: AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
    pcidss: Req-10.5.5
    srg: SRG-OS-999999
    stigid: RHEL-06-000182

ocil_clause: 'the system is not configured to audit changes of the network configuration'

ocil: |-
    To determine if the system is configured to audit changes to its network configuration,
    run the following command:
    <pre>auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'</pre>
    If the system is configured to watch for network configuration changes, a line should be returned for
    each file specified (and <tt>perm=wa</tt> should be indicated for each).
