Skip to content

Commit

Permalink
Have users reload auditd after changing the config
Browse files Browse the repository at this point in the history
Signed-off-by: Tim Smith <[email protected]>
  • Loading branch information
tas50 committed Nov 18, 2024
1 parent 225a130 commit ff06ab6
Showing 1 changed file with 18 additions and 0 deletions.
18 changes: 18 additions & 0 deletions core/mondoo-linux-security.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -1251,6 +1251,12 @@ queries:
```
max_log_file = <MB>
```
Restart the service to load the new configuration values:
```
service auditd reload
```
- uid: mondoo-linux-security-audit-logs-are-not-automatically-deleted
title: Ensure audit logs are not automatically deleted
impact: 40
Expand All @@ -1268,6 +1274,12 @@ queries:
```
max_log_file_action = keep_logs
```
Restart the service to load the new configuration values:
```
service auditd reload
```
- uid: mondoo-linux-security-system-is-disabled-when-audit-logs-are-full
title: Ensure system is disabled when audit logs are full
impact: 40
Expand All @@ -1293,6 +1305,12 @@ queries:
action_mail_acct = root
admin_space_left_action = halt
```
Restart the service to load the new configuration values:
```
service auditd reload
```
- uid: mondoo-linux-security-changes-to-system-administration-scope-sudoers-is-collected
title: Ensure changes to system administration scope (sudoers) is collected
impact: 50
Expand Down

0 comments on commit ff06ab6

Please sign in to comment.