Configure auditd rules for security compliance

[Luke Hinds]

Currently no audit rules are set within the auditd system.

This results in events that modify the follow system attributes as not logged by auditd

* Events that Modify Date and Time Information
* Events that Modify the System's Discretionary Access Controls
* Record Events that Modify User/Group Information
* Record Events that Modify the System's Network Environment
* Record Events that Modify the System's Mandatory Access Controls (SELinux)
* Collection of Unauthorized Access Attempts to Files (unsuccessful)
* Collection of Information on the Use of Privileged Commands
* Collection of Information on Exporting to Media (successful)
* Collection of File Deletion Events by User
* Collection of System Administrator Actions
* Collection of Information on Kernel Module Loading and Unloading

A`/usr/share/doc/audit-2.4.1/stig.rules` file already exists which can be used to overwrite the file `/etc/audit/audit.rules`

For example:

~]# cp /etc/audit/audit.rules /etc/audit/audit.rules_backup
~]# cp /usr/share/doc/audit-version/stig.rules /etc/audit/audit.rules

This will then insure each of the above audit areas will be implemented and result in a system being DISA STIG compliant.

In the /usr/share/doc/audit-version/ directory, the audit package provides a further set of pre-configured rules files according to various certification security standards:

* nispom.rules — Audit rule configuration that meets the requirements specified in Chapter 8 of the National Industrial Security Program Operating Manual.

* capp.rules — Audit rule configuration that meets the requirements set by Controlled Access Protection Profile (CAPP), which is a part of the Common Criteria certification.

* lspp.rules — Audit rule configuration that meets the requirements set by Labeled Security Protection Profile (LSPP), which is a part of the Common Criteria certification.

* stig.rules — Audit rule configuration that meets the requirements set by Security Technical Implementation Guides (STIG).

If possible, name could be sourced / passed with a flag or key / value such as `stig` which will copy and overwrite the relevant rules file to /etc/audit/audit.rules.

Further details: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Defining_Audit_Rules_and_Controls_in_the_audit.rules_file.html

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/421872
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=eb14c2a9f7acd6a7949e7aee91687756731f93db
Submitter: Jenkins
Branch: master

commit eb14c2a9f7acd6a7949e7aee91687756731f93db
Author: Steven Hardy <email address hidden>
Date: Wed Jan 18 12:25:25 2017 +0000

    Add AuditD Profile

    This patch allows the management of the AuditD service and its associated
    files (such as `audit.rules`)

    This is achieved by means of the `puppet-auditd` puppet module.

    Closes-Bug: #1640302
    Co-Authored-By: Luke Hinds (<email address hidden>)
    Change-Id: Ie31c063b674075e35e1bfa28d1fc07f3f897407b

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/420040
Committed: https://git.openstack.org/cgit/openstack/tripleo-puppet-elements/commit/?id=7ab27c7dd2e93a326b862ee018466b9c5561aeec
Submitter: Jenkins
Branch: master

commit 7ab27c7dd2e93a326b862ee018466b9c5561aeec
Author: lhinds <email address hidden>
Date: Fri Jan 13 15:46:27 2017 +0000

    Add reference to puppet-auditd

    Needed to manage auditd so that operators can populate auditd parameters,
    and adhere to security compliance regulations.

    A decision to use puppet-auditd was made on the module being actively developed,
    having the highest user score.

    Partial-Bug: #1640302

    Change-Id: I5b3805333f2b97de7bde261b2f28c15884a7c2dd

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 6.2.0 release.