From 5690f1d41629bd3a7ea807068688024265c05ac5 Mon Sep 17 00:00:00 2001 From: Karl DeBisschop Date: Thu, 16 Nov 2023 08:58:35 -0500 Subject: [PATCH] auditd 5.2.3.12 logins should refer to /var/run/faillock Signed-off-by: Karl DeBisschop --- templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2 b/templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2 index c26bc611..83615822 100644 --- a/templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2 +++ b/templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2 @@ -1,2 +1,2 @@ --w /var/log/faillock -p wa -k logins +-w /var/run/faillock -p wa -k logins -w /var/log/lastlog -p wa -k logins