auditd 5.2.3.12 logins should refer to /var/run/faillock

ansible-lockdown · Nov 16, 2023 · d144ed9 · d144ed9
1 parent 8ae8827
commit d144ed9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2 b/templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2
@@ -1,2 +1,2 @@
--w /var/log/faillock -p wa -k logins
+-w /var/run/faillock -p wa -k logins
 -w /var/log/lastlog -p wa -k logins