Great Image but audit rules
This is a great image which has different filesystems for /var/log/ /var/log/audit /home and /tmp. When we tried to deploy the Redhat image and apply stigs, we found the audit and messages filesystems were overloading the kernel and the IO from those precluded the image from running in a healthy stage. Using this CIS image with the CAT II STIGs, made it perfect.
However, CIS is sloppy in apply the audit rules on this image. Out of the box we found that there exists a audit.rules and CIS.rules file that contain duplicate entries that error on the OS and with security agents that use the rules. This is just sloppy and should be addressed by CIS
There are no comments to display