jamf / cis-for-macos-high-sierra Goto Github PK

The way the expire-after is being set is causing audit_control to ignore the line and not clear the log files. The issue is that the flags are case sensitive. Currently line 445 in the Security_Remediation.sh script reads

sed "s/${oldExpireAfter}/expire-after:60D OR 1G" /etc/security/audit_control_old > /etc/security/audit_control

but the time flag needs to be lowercase.

sed "s/${oldExpireAfter}/expire-after:60d OR 1G" /etc/security/audit_control_old > /etc/security/audit_control

would be the correct syntax according to the man page for audit_control

I have several Mac build techs who would love to participate in getting this up to date for the newer OSes but we would rather participate in an overall community effort than just keep it all in house.

The matching check to Issue #3 in 2_Security_Audit_Compliance.sh has not been changed to match so Macs will always fail the 3.3 check. Line 767 needs to be changed.

	if [ "$auditRetention" = "expire-after:60D OR 1G" ]; then

should be

	if [ "$auditRetention" = "expire-after:60d OR 1G" ]; then