"Record Attempts to Alter Logon and Logout Events" issues on Ubuntu 22.04 about content HOT 5 CLOSED

we don't yet support CIS v2.0.0 as you can see here:
https://github.com/ComplianceAsCode/content/blob/master/products/ubuntu2204/profiles/cis_level2_server.profile

from content.

I believe that as a short solution, you could just send a PR removing audit_rules_login_events_tallylog from both cis_level2_server and cis_level2_workstation profiles, as well removing from audit_rules_login_events_tallylog rules.yml any mentions of ubuntu 22.04. That seems to be some leftover from 20.04 when the profile was first created

from content.

we don't yet support CIS v2.0.0 as you can see here: https://github.com/ComplianceAsCode/content/blob/master/products/ubuntu2204/profiles/cis_level2_server.profile

Same issue is present also using CIS v1.0.0

4.1.3.12 Ensure login and logout events are collected - Page 492

from content.

I believe that as a short solution, you could just send a PR removing audit_rules_login_events_tallylog from both cis_level2_server and cis_level2_workstation profiles, as well removing from audit_rules_login_events_tallylog rules.yml any mentions of ubuntu 22.04. That seems to be some leftover from 20.04 when the profile was first created

Changes for tallylog is ready. I need only to commit and create a PR.

What about /var/log/faillog ?

from content.

I believe that as a short solution, you could just send a PR removing audit_rules_login_events_tallylog from both cis_level2_server and cis_level2_workstation profiles, as well removing from audit_rules_login_events_tallylog rules.yml any mentions of ubuntu 22.04. That seems to be some leftover from 20.04 when the profile was first created

Changes for tallylog is ready. I need only to commit and create a PR.

What about /var/log/faillog ?

You should replace audit_rules_login_events_faillog with audit_rules_login_events_faillock

Just a reminder to move the ids from one rule.yml to the other.

from content.