auditd 5.2.3.12 logins should refer to /var/run/faillock

Signed-off-by: Karl DeBisschop <[email protected]>
ansible-lockdown · Nov 16, 2023 · 5690f1d · 5690f1d
1 parent 8ae8827
commit 5690f1d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2 b/templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2
@@ -1,2 +1,2 @@
--w /var/log/faillock -p wa -k logins
+-w /var/run/faillock -p wa -k logins
 -w /var/log/lastlog -p wa -k logins