Revision 1.6Mar 18, 2024
Functional Update
- 5.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
- 5.2.1.4 Ensure audit_backlog_limit is sufficient
- 5.2.3.6 Ensure use of privileged commands are collected
- 5.2.4.1 Ensure audit log files are mode 0640 or less permissive
- 5.2.4.2 Ensure only authorized users own audit log files
- 5.2.4.5 Ensure audit configuration files are 640 or more restrictive
- 5.2.4.6 Ensure audit configuration files are owned by root
- 5.2.4.7 Ensure audit configuration files belong to group root
